Spec reader

Published mirror - 0.5.0 (draft) (source flop-core@dfd98a59d). This file is generated; corrections are made upstream and re-published. Three publish-time transforms are applied to the spec: Appendix H's Code path · tracker column is removed, local links are retargeted to published paths/anchors or flattened when their file is unpublished, and machine-readable <!-- cite: --> gate comments are stripped. No normative text is altered. Tracker references of the form #NNN point at FLOP's internal engineering tracker, not at issues in this repository. Feedback: open an issue.

FLOP Network · Yellow Paper Normative specification of the FLOP protocol. Version0.5.0 (draft) StatusImplementation spec - iterating Updated2026-09-24

The implementation specification of the FLOP Network: notation, message and storage formats, extrinsic interfaces, state machines, algorithms, and protocol invariants. This is the authoritative reference an implementer builds against. It is the math/spec companion to the Whitepaper (conceptual) and Litepaper (overview).

How to read this document - see §0 first. The section bodies are normative and describe the target protocol using RFC 2119 keywords (MUST/SHOULD/MAY). Everything an implementer needs to satisfy conformance lives in the numbered sections and in Appendices A (parameters), F (message & storage formats), and G (extrinsic index). Everything that is not a requirement - design rationale, decision provenance, prior art, formal-proof citations - is confined to the Rationale & sources trailer at the end of each section, and to Appendix B. Implementation status (what is built vs. designed) is not carried in the normative body; it lives in one place, the Conformance & Status Matrix (Appendix H). Unresolved values/mechanisms are numbered stubs in Appendix E - Open Specification Items; the body references a stub rather than restating an open debate.

Decision provenance. Ratified positions are recorded once in decisions/v0.4.md (D-04xx, MADR-shaped, immutable once merged, superseded by ID in later versions). Where a normative rule cites a D-id, the citation is provenance only - the rule itself is stated in full in the body; the reader never needs the decision record to implement.

---

0. Conformance & Reading Guide

Normative keywords. The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as in RFC 2119 / RFC 8174 when, and only when, they appear in capitals. Lower-case uses carry no normative weight. A statement with no keyword is descriptive context, not a requirement.

What is normative. The numbered section bodies (§1-§15), Appendix A (Parameter Reference), Appendix F (Message & Storage Formats), Appendix G (Extrinsic Index), and Appendix I (Pallet Index Reference) are normative. Appendices B (Sources), C (Miner Lifecycle - a worked walkthrough), D (Fee & Revenue Map - a derived summary), E (Open Items), and H (Conformance & Status Matrix) are informative except where they restate a normative rule and cite its home section.

Section skeleton. Each protocol section is organized as:

1. Requirements - the normative rules (MUST/SHOULD/MAY).
2. Data structures - field · type · encoding · constraint (or a pointer into Appendix F).
3. Interfaces - extrinsics/functions: signature · origin · preconditions · errors · events (or a pointer into Appendix G).
4. State machine - states and a transition table, where the section defines one.
5. Rationale & sources (non-normative) - why the design is as it is, decision IDs, prior art, and formal-proof citations. An implementer MAY ignore this trailer.

Not every section needs every part; a part is present only where it carries content.

Reading the parameters. Every protocol constant is named in Appendix A, which is generated from params/flop-protocol-params.yaml (the single machine-checked source, gated by scripts/check_params.py). A parameter named in the body links to its generated #param-<name> anchor. Concrete figures appearing inline are worked examples; the value of record is always Appendix A.

Implementation status is out of band. This specification describes the protocol FLOP targets, not a snapshot of the codebase. The build state of each requirement - implemented, in progress, or designed - is tracked only in Appendix H, together with the code path and any tracking issue. The body contains no [LIVE]/[PARTIAL]/[PLANNED] tags and no commit/PR references, so a requirement's wording does not change as code lands.

Trust-domain principle. FLOP's verification architecture rests on an explicit rule that recurs throughout §3, §7, §11, and §12: a fallback verification layer MUST occupy a different trust domain from the fast path it backs. In particular, protocol soundness MUST NOT rest on any single hardware root of trust. TEE attestation is one assurance tier (§3.3) and is OPTIONAL, not a precondition for participation or settlement; the mandatory execution-integrity floor is the TEE-independent stack of activation commitments, sampled re-execution, and slashing (§3.4-§3.5). This is ratified as D-0432; the non-TEE (SOFT) tier's end-to-end definition is the open item E.33.

Terminology and clocks. §1 fixes the notation, the role glossary, and the canonical protocol-clock table with its coupling invariants. All durations assume 1-second blocks.

0.1 System architecture (informative reading map)

FLOP is a verified-inference settlement layer: a Substrate/FRAME chain where autonomous agents pay miners for attested inference, validators finalize and police it, and the token economy is gated on useful, verified, demanded work. The actors:

End-to-end happy path (one paid session):

flowchart LR
  A["Agent §6.2"] -->|open channel + escrow| CH["compute-channel §12"]
  A <-->|attested turns| M["Miner §3 §4 §7"]
  M -->|TOPLOC + quote to DA| DA["validator DA §5.3"]
  CH -->|settle aggregate Gn| GN["Gn credit §4"]
  GN --> REW["rewards + vesting §8 §9"]
  V["Validators §2 §15"] -->|author + finalize| CH
  V -->|attest + serve + adjudicate| CH
  V -.->|sampled re-exec + slash| M

How the sections compose (what each depends on):

• §2 Consensus is the base: BABE authors, AlephBFT finalizes. Every irreversible action anywhere reads its finalized prefix - settlement (§12), HTLC refund (§10), slashing (§11), DA prune (§5.3).
• §15 Validators is the staked set that runs §2, performs §3.6 attestation, and hosts §5.3 DA; its committee gate (§2.3) needs §3's verified-work signal.
• §7 Calibration produces B_p / serving caps consumed by §4 metering, §6.1 miner stake, §8 vesting, and the §11 settlement gate.
• §3 Verification decides what may be credited; it consumes §7 caps, §5.3 DA (evidence), and §12 transcripts. §4 Metering defines the G_n unit that §8, §9, §11, and §12 all key on.
• §12 Sessions is the settlement hot path - it reads §2 finality, §3 verification, §4 G_n, §5.3 DA, §7 caps - and feeds §8/§9 (economics). §5.3 DA stores the evidence §3/§12 disputes fetch.
• §9 Emission / §8 Vesting are the economic outputs, gated on demanded+verified §4 work; §10 HTLC moves value cross-chain in/out. §14 Governance controls parameters/upgrades over all of the above.
• §11 Invariants and §13 Failure semantics cross-cut every section; §6 supplies the accounts, keys, and escrow primitive the whole system is built on (crypto/accounts: §6.5).

Appendices are reference surfaces: A parameters · F message/storage formats · G extrinsics · H conformance/status · I runtime composition (pallet indices). A companion yellowpaper-attribution.md maps each requirement to its proof + code.

---

1. Notation, Conventions & Glossary

Quantities are exact integers on-chain unless noted; rationals use fixed-point (parts-per-million, ppm, or parts-per-thousand, ppt). FLOP balances carry 18 decimals, so the base unit is 10⁻¹⁸ FLOP and all on-chain balances are integer counts of it; the base unit has no separate name and amounts are written either in FLOP or as a count of base units. ‖ denotes concatenation; SHA256 and blake2_256 denote the respective 32-byte hashes.

1.1 Glossary - roles vs software

A node is software; every other term below is a staked or delegated role. Validators and miners each run a node plus role-specific services. The terms are used in exactly these senses throughout.

Attestation authority. There is no separate oracle role. Active validators verify TEE quotes off-chain and submit signed ValidatorAttestation bundles; a BFT quorum of active validators (§3.6, §13.3) is the on-chain attestation authority.

1.2 Protocol clocks - canonical table

Every time constant that a security argument depends on, in one place. Coupling invariants are the rules that keep the clocks consistent; enforced couplings are checked in code, principled ones are review rules. All durations assume 1-second blocks. Values of record are in Appendix A.

• R1.2a - Complete-dispute transcript retention. Ephemeral DA retention W MUST exceed D + (2·⌈log₂ n_max⌉ + 2)·R, covering maximum-depth bisection, the terminal leaf response, and one R13.0b degraded extension. force_settle MUST check the referenced blob at that future block before pinning it; a usage pin prevents pruning but MUST NOT extend the blob's expiry. integrity_test MUST enforce the configured constant bound.

Reading rule (normative review gate). A shorter clock MUST NOT be able to strand a longer one it secures: disputes fit inside retention, stake outlives disputes, checkpoints outlive exits, enactment outlives unbonding. Any change to one of these values MUST re-check the coupling column.

1.3 Acronyms & technical terms

Every acronym and non-obvious technical term used in this spec, expanded once. Protocol-internal identifiers (open_channel, report_data, …) are defined at their point of use and in Appendices F-G; the roles/symbols are §1.1.

Consensus & runtime

PoUI & verification

Data availability & storage

Economics, governance & crypto

Threat-model frameworks (referenced, not defined here): OWASP Agentic Top-10, ATFAA, STRIDE, and MITRE ATLAS are external catalogues cited in §12.3.

---

2. Consensus

FLOP's consensus is a BFT-DAG (AlephBFT class) under the Substrate/FRAME runtime. A stake-weighted, PoUI-gated sampler selects distinct committee identities; once selected, those identities participate as committee seats in AlephBFT. BABE authors blocks; AlephBFT finalizes them - GRANDPA (Substrate's default finality gadget) is not used. BABE's one-second slot is fixed; no finality-latency or throughput profile is specified until E.46 is measured under a disclosed workload and topology.

2.1 Requirements

• R2.1 - Block authoring. Blocks MUST be authored by BABE at a fixed 1 s interval.
• R2.2 - Finality. A block MUST be treated as irreversible only once it is within the AlephBFT finalized prefix. Every fund-releasing, expiry, slashing, or pruning action MUST read the finalized prefix via hp_consensus::FinalizedPrefix (AlephBFT-backed through pallet_aleph::LastFinalized), never the chain tip.
• R2.3 - Byzantine tolerance. AlephBFT safety MUST be evaluated against Byzantine committee seats, because selected members sign with equal voting weight. The safety premise MUST be strictly fewer than one third Byzantine seats: 3f < n, where f is the Byzantine seat count and n is the realized committee size. Eligible-set or realized-committee stake fraction MUST NOT replace this seat bound.
• R2.4 - Committee gate. Finality-committee membership MUST be restricted to the PoUI-gated set: stake at or above the effective minimum and a recent accepted verification duty (R15.4c; hp_consensus::select_committee; §2.3, §15.4). Eligibility MUST NOT require the validator to execute inference, produce PoUI proofs, or hold a GPU or TEE. A bootstrap exception or minimum-safe-size profile MUST be ratified before that mode can claim conformance (E.42).
• R2.5 - Committee size. The finalizing committee MUST be a stake-weighted random sample of finality_committee_size distinct members drawn without replacement from the eligible set, seeded by BABE-VRF epoch randomness (§15.4).
• R2.6 - Engine isolation. Finality-assuming pallets MUST depend only on the hp_consensus::FinalizedPrefix interface, so the finality engine can be swapped without touching them. FRAME MUST remain the sole execution/state layer.
• R2.7 - Byte budget. A claimed throughput/finality profile MUST state its admitted byte and weight budgets and validate them under a disclosed workload and network topology (§5.2, E.46).

2.2 Target parameters

The committee cap of 100 is cost-derived. At the original 1.5 FLOP floor the validator reward pool sustained 112 bare-metal validators, which is where the cap of 100 was sized. D-0436 doubled the floor to 3 FLOP/block, so that pool now sustains **224**: the cap sits roughly 2.2x inside the ceiling rather than at it, and validator cost is no longer the binding constraint on committee size. Capture analysis is parameterized by realized committee size; an N=100 bound MUST NOT be applied to an undersized committee. Bootstrap and minimum-safe-size behavior are E.42.

2.3 Safety - the three sub-proofs

PoUI gates production on stake + verified useful work, not hashpower, so a longest-chain Nakamoto safety theorem does not apply and MUST NOT be relied upon. Safety instead decomposes into three independent sub-proofs, each in its own trust domain:

1. Committee Sybil cost. A committee identity costs validator stake only, with no hardware, calibration, or Ghost-Task term: eligibility is stake at or above effective_minimum_stake() (whose baseline is validator_min_stake) plus a recent accepted verification duty (R15.4c), and the duty is an eligibility condition, not a cost. Validator and miner stakes are self-stake only (third-party delegated staking is prohibited). Sponsored stake (E.32) may count toward that floor, but only self-stake counts as an identity's Sybil capital: sponsored backing need be neither the operator's own nor distinct across identities. The cost of k identities is therefore the sum of their self-stakes, not k · effective_minimum_stake(). Where a sponsor-posted bond counts as self-stake (R6.1a), the cost of sponsored identities is the sponsor's capital and rests on the sponsor's admission of operators. E.42 must bound that self-stake and bridge it and the implemented sampling to the honest-seat premise of (2); a mode that seats identities without a recent duty is an E.42 exception. MaxSlotsPerEntity is self-declared and is not a Sybil cost. Appendix H records where the deployed runtime departs from this model.
2. BFT ordering safety under honest seats. Given < ⅓ Byzantine committee seats, AlephBFT atomic broadcast supplies its agreement and total-order result (adopted from AlephBFT; not re-proven here). The PoUI/stake gate constrains eligibility but does not by itself establish this realized seat premise.
3. Verification integrity. Committee eligibility requires a recent accepted verification duty (R15.4c - attesting, adjudicating, auditing; never proof production), and rewards/settlement are gated by the tiered verification stack (§3). Subject to actual enforcement of the gate and verification bridge (E.42-E.44, E.52), this constrains stake-only eligibility and unverified reward credit. It does not prove honest consensus behavior.

The probabilistic bridge from eligible-set composition to the realized seat premise is unresolved (E.42). In particular, weighted sampling of distinct identities with unequal stake is not binomial sampling by aggregate attacker stake. SelectionTailDominated in the Lean model is an explicit hypothesis, not a theorem about the implemented sampler. Capture analysis must model the actual eligible identities, their weights, the without-replacement draw, stake splitting, small eligible pools, repeated epochs, and BABE-VRF seed influence.

2.4 Sybil model - miner and checker identities

For miners, and for calibrated miner identities serving as checkers, eligibility is gated by stake + attested hardware (not hashpower). A Sybil is many identities seeking extra reward, selection weight, or penalty-dodging. Per miner/checker identity cost is a triple moat:

Sybil cost(N miner/checker identities) = N · (stake bond ≥ min_miner_self_stake)
                                        + N · (genuine attested silicon, where a HARD/TEE cap is claimed)
                                        + N · (accepted burst cap + background Ghost-Task exposure)

Residual miner/checker attacks and required mitigations:

The triple moat's TEE term is decisive for the HARD tier, where an identity is bound to a distinct attested device. A SOFT (non-TEE) identity is instead bounded by stake + calibration + spot-check exposure; its per-identity demand-floor exclusion is E.33.

Rationale & sources (non-normative)

Consensus is the ratified stake-BFT-DAG (Q1 = D2). The choice within DAGs is the finality model: GHOSTDAG buys throughput at the cost of probabilistic finality and an honest-hashpower assumption, which PoUI removes; a BFT-DAG orders the DAG with Byzantine agreement so the committed prefix is irreversible at commit under the < ⅓ Byzantine-seat premise. Stake governs eligibility and sampling weight, while the current signature verifier counts seats; these are separate quantities. The only DAG option with a direct FRAME precedent is Aleph Zero. The prior PoW-GHOSTDAG fork was deleted (unintegrated; its safety proof void under PoUI). Prior art: the BABE-authors / AlephBFT-finalizes split is the availability-finality (Ebb-and-Flow, arXiv:2009.04987) resolution; AlephBFT (arXiv:1908.05156 / 2312.14506) supplies expected-constant-round asynchronous agreement; deterministic BFT in a block DAG (arXiv:2102.09594; Shoal++ arXiv:2405.20488; Lemonshark arXiv:2604.03974). The decomposition is confirmed by results that a non-PoW longest-chain rule can be insecure (arXiv:2505.14891) and that optimization-PoUW inherits PoW's honest-majority need (arXiv:2405.19027) - both avoided by not using a longest-chain rule.

Written sub-proofs: q14-sybil-cost-proof.md, q14-bft-ordering-safety.md, q14-useful-work-integrity.md; options analysis consensus-runtime-composition.md; implementation record alephbft-integration-plan.md; Sybil cost model sybil-mitigation.qnt. The committee-sampling risk bridge is machine-checked in FlopSpecs/CommitteeSampling.lean; its tail bound is conditional on SelectionTailDominated. The finite quorum-intersection and certificate-nonforking argument is proved in FlopSpecs/Consensus.lean: Committee.quorum_inter_gt_third and FinalCtx.nonforking. For AlephBFT's equal-seat committee, instantiate the model's weight function with one per seat: the fault premise is 3f < n and a quorum has 3q > 2n distinct signers. For n = 100, this permits at most 33 Byzantine seats and requires 67 signatures. The proof assumes quorum-certified finalization and honest non-equivocation; it does not establish the sampler's honest-seat premise or the running protocol's liveness. Review evidence and counterexamples: prepublication-evidence.md. Exact population enumeration and real-sampler regression scope: committee-sampler-evidence.md. The current sampler returns all members of any nonempty eligible pool of at most 100; when no active validator clears both the stake floor and recency (including when every recent-work validator is below the floor), the runtime retries with a stake-only set. These modes are implementation status, not safety evidence; Appendix H and E.42 track the conformance gap. Provenance: D-0401, D-0501 (seat-count premise and conditional sampling bridge). Status: Appendix H.

---

3. Proof of Useful Inference - Verification Architecture

PoUI answers: did a miner execute the claimed inference (this model, this output) using the claimed compute, or spoof a cheaper one? No single primitive does this cheaply, so FLOP uses a tiered hybrid whose central rule is that the fallback layer occupies a different trust domain from the fast path (§0). ZK-proving the forward pass is out of scope: prover cost scales with proven FLOPs at 10³-10⁶× blowup - prove a cheap check, never the forward pass.

3.1 Requirements

• R3.1 - Execution-integrity floor (TEE-independent, mandatory). Every settled session MUST carry a TOPLOC activation commitment (§3.4) over its turns. Missing required evidence MUST fail settlement closed; there is no TOPLOC-less settlement lane.
• R3.2 - TEE is optional. A TEE attestation (§3.3) MAY back a session and, where present, raises its assurance tier (HARD) and its permitted value cap. Protocol soundness MUST NOT depend on TEE integrity: if a TEE quote is forged or its trust root fails, acceptance MUST still require an independently enforced fallback with a stated error bound. Combining marginal error probabilities by multiplication MUST require a justified conditional-independence model; without it, two enforced gates support only the general intersection bound min(ε_tee, ε_fallback). A non-TEE (SOFT) miner class is a first-class participant (D-0432; its end-to-end definition is the open item E.33).
• R3.3 - Independent re-execution. Security against a compromised fast path MUST come from optimistic re-execution in a different trust domain (§3.5), with collectible collateral and aggregate exposure satisfying the stated p_effective deterrence condition (E.45).
• R3.4 - Settlement gate. Crediting on the direct PoUI proof rail MUST require a BFT quorum of distinct active validators (§3.6): ceil(active_count × validator_attestation_threshold).max(1).
• R3.5 - Binding. An accepted proof/attestation MUST bind, at minimum, task_hash, the metered gn_weight, the measured model_hash, and the output_hash; a mismatch on any bound field MUST reject (OutputHashMismatch / root mismatch).
• R3.6 - Replay. Each task_hash MUST be creditable at most once (ProcessedTasks guard).

3.2 The verification stack

flowchart TB
  subgraph OFF["Off-chain (heavy, untrusted-but-verified)"]
    I["Inference<br/>(weights measured, I/O bound)"] --> TC["TOPLOC activation commitment (required)"]
    I -. optional .-> Q["TEE quote + report_data (HARD tier)"]
    Q --> OR["validator tee-bridge<br/>DCAP verify (off-chain)"]
  end
  subgraph ON["On-chain (minimal, consensus-critical)"]
    OR --> AT["sr25519 ValidatorAttestation bundle<br/>(BFT quorum of active validators)"]
    AT --> V{"verify sigs + active-validator check + report_data<br/>+ BFT quorum + ProcessedTasks replay"}
    V --> CR["credit G_n → aggregate (Merkle) → settle"]
  end
  TC -. commitment .-> DA[("DA layer")]
  DA -. spot-check (prob p) .-> RX["Independent re-execution<br/>(different miner) + slashing"]
  RX -. dispute .-> CR

3.3 Tier 1 - TEE attestation & measuring model_hash (optional / HARD tier)

Where a session runs under confidential computing, NVIDIA CC (H100/H200/Blackwell) + an Intel TDX host CVM attest a genuine device, CC-mode/VRAM encryption, and firmware/RTMR measurements; the host quote (MRTD, RTMR0-3, report_data) is checked by DCAP / dcap-qvl. The attestation proves the environment, not which model ran - so it never substitutes for the Tier-2/3 floor.

Measuring model_hash. When a TEE session claims a model, the commitment to the loaded weights MUST be a measured dm-verity Merkle root, not a passed-in checksum:

1. Pack all weight shards + index + config into one read-only EROFS image with a dm-verity Merkle tree (4 KB blocks). The root hash is the commitment; the kernel verifies every block on read and faults on mismatch, so the engine can only read the committed weights. The reproducible packer is [tools/modelpack].
2. The miner CVM MUST extend the root into RTMR3 as a TDX event-log entry so it appears in the signed quote and flows into report_data. No other register or measurement path is accepted.
3. The chain stores expected roots per (model, precision) in pallet_model_registry and MUST accept a TEE proof only if the quote's measured root ∈ registry (fail-closed Vk::V3; the dstack verifier parses the TDX event log, replays it to the quote's RTMR3, and requires the registry root among the RTMR3 events). Quantization changes the bytes → changes the root, so each precision variant is a distinct commitment (consistent with TOPLOC precision detection).

Output binding. report_data MUST also commit output_hash; the validator MUST reject a mismatch. Decode-policy binding. report_data MUST commit decode_policy_hash - a canonical digest over greedy/temperature/top-p/top-k/seed plus transform id. Governance MAY pin a model to an allowed decode-policy set in the registry (≤ max_decode_policies_per_model); absent a pin, policy rollout is unblocked. The full binding preimage is in Appendix F.

3.4 Tier 2 - TOPLOC activation commitments (mandatory floor)

TOPLOC commits the top-128 values+indices of each token's last hidden state, polynomial-encoded to ~258 bytes / 32 tokens. A verifier re-executes a single prefill and compares exponent intersections then mantissa error against a per-(model, precision) governance-calibrated band. The committed lanes and the re-executed step are the prefill; a commitment and check that cover the decode steps and bind them to the billed token ids (h_ids) are open in E.43.

• R3.4a. A TOPLOC commitment MUST be present for every session (R3.1) and published to DA to feed Tier 3. A cryptographic detection bound additionally requires that the commitment bind the challenged activation vector, challenge randomness be fixed after commitment, and openings be checked against that commitment; the end-to-end protocol bridge is E.43.
• R3.4b. Band adjudication MUST be fail-closed per (model, precision, backend, GPU) cell: until a cell's hetero-hardware activation gate passes, the cell is commitment-required but adjudication-inert (no silent accept). The two-threshold policy is accept / escalate / slash; a middle escalate verdict MUST route to the escalation lifecycle within channel_toploc_escalation_window_blocks, never to silent accept.
• R3.4c. Unauthorized model/precision/prompt/decode/numerical substitution MUST be treated as disputable execution fraud. TOPLOC's detection claim is limited to validated cells and the commitment, challenge, and adjudication assumptions in E.43. Answer quality is out of protocol scope - a market/reputation remedy, never a protocol fraud verdict. This boundary is normative.

The tolerance-band formula combines an honest-divergence model with a secret-challenge projection model; the committed per-cell constants (kappa_profile_hash, band_tau_accept, band_tau_slash, …) are in Appendix A. These formulas give conditional mathematical bounds under their stated distributions. They do not establish empirical detection for every model/backend/GPU cell or prove that the deployed commitment, challenge, opening, audit, and adjudication path enforces those assumptions. Under a broken TEE, the abstract AND-combinator retains the supplied fallback bound; the bound is only as strong as the fallback and operational bridge independently established in E.43.

3.5 Tier 3 - Independent optimistic re-execution & slashing

Security against a compromised fast path is conditional on effective re-execution in a different trust domain. A Proof-of-Sampling game targets a random fraction: results are posted under bond and a different miner re-runs sampled work. For a risk-neutral miner under fixed monitoring and credible, collectible penalties, a necessary deterrence inequality is

p_effective · collectible_penalty  >  total_profitable_exposure

• R3.5a. There MUST exist ≥1 honest standing challenger - the session agent (for its own channel) or an active validator (for any channel), per §12.1.
• R3.5b. Slashable collateral MUST cover aggregate concurrent exposure, not only a single job; high-value jobs SHOULD escalate to a ZK spot-proof (§3.6). The reservation and payoff model is unresolved in E.45.
• R3.5c. Disputes MUST resolve over data available outside the miner's host. Validator-hosted DA removes miner-only custody but is not independent of a validator coalition (§5.3). The dispute bisection MAY use O(n²) Freivalds spot-checks so only a single layer/GEMM is re-run at the leaf.
• R3.5d - Re-execution lane. Re-execution of sampled or challenged turns MUST be performed by bonded checkers in a different trust domain from the miner, never by validators. The floor is three checkers per turn - distinct operators from the miner and from each other, VRF-assigned - returning a unanimous verdict; any disagreement, or unavailable evidence, model or capacity, MUST escalate (§12.1) and MUST NOT become an implicit accept. A checker verdict carrying a TEE attestation of the re-execution is an OPTIONAL strengthening that raises the verdict's assurance tier and permitted value cap; it MUST NOT lower the floor. Before co-signing a mismatch or clear quorum at the §3.6 threshold, a validator MUST verify the assignment, the checkers' bonds, the signatures' binding to the commitment and turn, and unanimity. Checker identity MUST be a calibrated miner identity of §2.4 - capacity-proportional self-stake, accepted calibration cap and an independently attested hardware fingerprint - plus the checker bond; a bare bonded account is not checker-eligible. Assignment MUST be stake-weighted VRF sampling over that pool excluding the session miner's account and fingerprint, and the three assigned checkers MUST carry pairwise-distinct fingerprints, so an adversary holding share q of the pool's selection weight captures all three seats with probability at most q³, bounded by the Sybil cost of §2.4. A unanimous accept is not final: within the R12.1f challenge window any standing challenger MAY escalate it, drawing a fresh assignment disjoint from the first, and a checker whose verdict is overturned MUST forfeit its bond. Verdict fields and checker payment are E.53.

Here p_effective is the probability chain P(selected) · P(data | selected) · P(challenge | selected,data) · P(included | selected,data,challenge) · P(upheld | selected,data,challenge,included) · P(collectible | selected,data,challenge,included,upheld). Every factor conditions on all preceding events; this is the chain rule, not an independence or Markov assumption. The inequality alone does not establish a Nash equilibrium for challengers, coalitions, bribery, or Byzantine actors. Slashing is pallet_miner_slashing; the session dispute game is §12.1.

3.6 Tier 4 - On-chain settlement, ZK aggregation & validator BFT quorum

The direct per-proof rail settles synthetic/ghost, calibration, and simulator work; paid agent sessions settle through the compute channel (§12.1), with the validator quorum acting there as dispute resolver rather than per-credit gatekeeper. On the direct rail:

• R3.6a. A miner submits a proof via submit_stark_batch(...), recorded in PendingVerifications with replay protection (ProcessedTasks[task_hash]).
• R3.6b. Crediting MUST require a validator BFT quorum. Validators run DCAP/dstack TEE quote verification off-chain and submit signed ValidatorAttestation bundles via submit_validator_attestations. The chain MUST: verify each sr25519 signature; check every signer is an active validator (pallet_validators::ActiveValidators); enforce agreement on (task_hash, gn_weight, latency_ms, model_hash, output_hash, decode_policy_hash, tee_type, quote_verified, event_log_verified, hardware_id_hash) across the bundle; require both verification booleans; and require ceil(active_count × validator_attestation_threshold).max(1) distinct validators (default threshold validator_attestation_threshold = 2/3, root-governable).
• R3.6c. On quorum the chain MUST verify the report_data binding + output_hash match, credit gn_weight, and fire OnProofVerified.

There is no separate oracle registry; the attestation authority is a BFT quorum of active validators already securing consensus. The Aggregate pallet collects verified statement hashes (keccak256) into per-domain Merkle roots for cross-chain dispatch; the settlement verifiers (Groth16-161 … EZKL-169, TEE-170) are zkVerify aggregation - they do not prove the inference. Optional ZK spot-proofs cover top-value jobs.

Rationale & sources (non-normative)

The stack draws on published mechanisms and prototypes (TEE confidential inference - Azure CVMs, Phala, Tinfoil; dm-verity model measurement - Tinfoil Modelpack; TOPLOC activation commitments - Prime Intellect, arXiv:2501.16007; TEE fast path + sampled re-execution + slashing - VeriLLM ~1% cost arXiv:2509.24257, SPEX arXiv:2503.18899, EigenAI arXiv:2602.00182 whose deterministic inference removes the FP-noise band, Optimistic TEE-Rollups arXiv:2512.20176; weight-into-attestation binding - Laminator arXiv:2406.17548, Attestable Audits arXiv:2506.23706). The TEE-optional reframe is grounded in the machine-checked sessionVerifier_survives_broken_tee (the abstract AND-combinator retains its supplied fallback bound under a forged quote) and the SOFT-tier design (E.33). Successor commitment schemes (TensorCommitments arXiv:2602.12630, DiFR arXiv:2511.20621, log-prob tracking arXiv:2512.03816) slot in as measured (ε, φ) points - their gains are verification cost, not the guarantee.

Walkthroughs: ELI5 · Feynman · session-lifecycle-runbook.md. Tiered hub: verification-architecture.md, verification.md, verification-economics-bounds.md, dispute-reexecution-tradeoffs.md, formal-to-implementation-bridge.md. Band derivation: toploc-band-derivation.md; operational R1-R4: toploc-r1-r4-research.md; decode-side conformance gap against R3.4c: decode-substitution-gap.md. Tier-3 primitives: freivalds-bisection-spec.md, commodity-reexecution-reference.md (tinygrad + Colibri as candidate GPU-optional leaf re-executors), distribution-audit-tier-design.md, cheap-miner-hardware-profiles.md, claim-then-audit-image-commitments.md. GPU-work measurement + premium cert lane: gpu-work-measurement-verification-study.md, batch-work-certificates-spike.md, gemm-certificate-format-spec.md, kv-commitment-carryover-design.md, zk-prover-overhead-audit-lane.md, zk-audit-settlement-design.md (ZK-wrapped audit verdicts + settlement bookkeeping, design spike); stack governance verification-scheme-registry.md. Trust surface: docs/trust-surface.md. Review evidence and assumption classifications: prepublication-evidence.md. Conditional audit payoffs, shared collateral, and collection-path evidence: audit-economics-evidence.md. Provenance: D-0404 (measured model_hash), D-0406/D-0414 (attestation authority), D-0431 (TOPLOC required), D-0501 (claim scope and conditional guarantees). Formal: FlopSpecs/Crypto.lean, FlopSpecs/TeeAttestationFlow.lean, FlopSpecs/Verification.lean, FlopSpecs/VerificationComparison.lean, verification/proof-verification.qnt. Status: Appendix H.

---

4. Effective-FLOP Metering

4.1 Requirements

• R4.1 - Unit. Work MUST be accounted in versioned reference-work units F_eff, with G_n = floor(F_eff / 10⁹). This is a deterministic protocol accounting convention; it is distinct from physical FP16/INT8/INT4 instruction counts, energy, latency, and certificate weights.
• R4.2 - Reference-work accounting. G_n MUST be computed from execution inputs by the shared deterministic no_std primitive (hp_poui::flop_meter, mirrored in tee-bridge/inference/attestor/flop_meter.py), not derived from bare 2·P·N. Inputs include the prompt/context lengths, generated-token count, active-parameter/MoE terms, and attention term defined by the reference formula. Running the meter inside a TEE does not make it a physical instruction counter or establish unmodeled routing, cache, batching, or speculative-decoding work.
• R4.3 - Tripwire is reject-only. A sanity tripwire MUST reject (never clamp or rewrite) a claim whose implied throughput gn·1000/latency_ms exceeds throughput_tripwire_gflops_per_sec (fail-closed, governance-toggle, default-on). The per-GPU MLPerf ceiling and the under-report floor activate where the attested GPU id / attested token counts are bound (transcript-leaf g_n).
• R4.4 - Representation. Settled G_n is an unsigned count of whole billion-reference-FLOP units. Direct-rail claims use u64; session leaves, receipts, aggregates, and balances use u128. Both use fixed-width little-endian integers in signed/hashed preimages and SCALE's fixed-width encoding in calls and storage. Implementations MUST floor once at F_eff / 10⁹, reject a value outside the destination width, and use checked aggregation; they MUST NOT round, clamp, reinterpret historical values, or attach physical FP16/INT8/INT4-op, joule, latency, or certificate-weight semantics to this field. Those measurements are separately typed telemetry.
• R4.5 - Cache accounting. Wire profile v1 bills the full prompt/context term in the reference formula, including a reused KV-cache prefix. Cache reuse may reduce latency or physical work but does not discount settled G_n. A proof-bound cache discount requires a new meter/profile version; it MUST NOT silently change existing leaf or receipt amounts (E.22; #1153).

4.2 The op-count model

The reference-work count accounts active params (MoE-aware), the quadratic attention term, and embedding; it is KAT-pinned against the analytic count on reference models (Llama-3-8B → 16, Llama-3-70B → 140 G_n/token; Rust ⇄ Python parity). Cross-checks (GPU performance counters via CUPTI/DCGM; energy via nvml) read inside the enclave as physical bounds.

The bare heuristic is a sanity check only (R4.3), never a billed amount:

F_eff ≈ 2 · P_active · N  +  2 · n_layer · n_ctx · d_attn   (attention term)

Per-token, per-layer: QKV 6d², attn output 2d², FFN 16d². The bare 2·P·N is ~2-3× accurate (it omits the quadratic attention term, embedding/unembed, LayerNorm/softmax; MoE uses active params; KV-cache is a bandwidth, not a FLOP, effect). Reference examples (≈, under stated architecture assumptions): Llama-3-8B 16, DeepSeek-V3 74, and Llama-3-70B 140 G_n/token. Proprietary-model figures are not protocol measurements.

Pricing vs. work. Pricing is quoted in tokens with context/model multipliers while work is metered in F_eff (flop-poui fee (base+priority)·gflops/1000·precision_mult). The transaction fee's recipient split is specified in §9 / Appendix D. G_n alone cannot convert an external per-token quote into a comparable session price; the versioned pre-session quote contract, its interface home, and its remaining blockers are E.55.

Rationale & sources (non-normative)

Reference-work G_n with a reject-only tripwire (never rewriting the billed amount) is D-0405; D-0501 clarifies that the meter is an accounting rule rather than exact physical measurement. Grounding: latency-gflop-calibration.md, workload-class-metering.md, gpu-precision-tripwire-note.md. Formal: FlopSpecs/Calibration.lean, FlopSpecs/Computable.lean. Review evidence: prepublication-evidence.md. Open: E.34 (non-LLM workload classes) and E.22 (proof-bound cache discount). Status: Appendix H.

---

5. On-chain / Off-chain Architecture & Sizing

5.1 The split

Verification asymmetry (normative). The chain MUST NOT re-execute the model; it adjudicates attestations and disputes only. Trust shifts to (a) hardware RoT where claimed, (b) economic slashing, (c) independent re-execution - never the executor.

5.2 Block & transaction sizing

The runtime configures a 5 MiB maximum block length: Normal dispatch may consume at most 3,932,160 B (75%), while Operational dispatch may use the full 5,242,880 B. Its independent ref-time ceiling is 750,000,000,000 per block, with 562,500,000,000 available to Normal dispatch; proof size is also a weight dimension. Base block/extrinsic work and competing traffic consume these envelopes.

These are admission maxima, not a propagation, execution, throughput, serving, or finality profile. D-0502 proposes to withdraw the former 125,000 B scenario. Whether bytes, ref-time, proof size, state access, serving capacity, or finality communication binds first requires E.46's runtime and network measurements.

5.3 The verified-task footprint & sovereign DA

A verified task MUST commit only ~32 B per blob on-chain, not the bytes. The ~2 MB StarkProof cap is a submission call-data path (it rides the extrinsic transiently and prunes with the block), not permanent storage - proofs/quotes/I-O live in DA, referenced by hash:

direct-rail attestation Vec bytes/claim = compact_len(quorum_size) + 275 B × quorum_size
off-chain (DA, by DataRef)              = proof_data, TEE quote (5-10 KB), event log (≤256 KB)

The current fixed-field SCALE size is 275 B per ValidatorAttestation; the signed subset is 179 B. The signature bundle is linear in quorum size. The source-checked SCALE fixtures include the runtime pallet/call indices, v5 bare preamble, outer compact length, and embedded validator signatures. Under the default two-thirds rule, 100 active validators require 67 signatures: the argument vector is 18,427 B and the complete extrinsic is 18,434 B. At the supported active-set maximum of 200, 134 signatures produce 36,852 B and 36,859 B respectively. The seven-byte difference is two call-index bytes, one bare-preamble byte, and a four-byte length prefix. The finality committee is a separate set capped at 100; 1,000 active validators is not a supported runtime state. No constant-size signature aggregation is specified. These byte measurements are not divided into a throughput claim; charged weights, competing traffic, and finality remain separate constraints. Full fixtures and limitations: prepublication evidence.

DA requirements (sovereign, validator-hosted, FLOP-denominated).

• R5.3a. DA storage MUST use no external currency/token/network dependency; validators are the storage nodes under stake. pallet_da_registry keeps only a DataRef = (commitment, provider_id, retention_class) plus the assigned validator subset and audit bookkeeping; the erasure-coded bytes (Reed-Solomon rate ½, da_shard_count R=6, any da_min_replication_factor k=3 reconstruct) live off-chain on a deterministic stake-weighted subset (hash(commitment) → subset). Because the publisher can influence a commitment, the assignment's anti-grinding rule, operator/failure-domain diversity, repair process, and cumulative retention budget remain open in E.47.

• R5.3b - Serve-or-slash. Retrievability audits (the Ghost-Task known-answer pattern) MUST slash a bounded amount (da_serve_or_slash_percent, Liveness class, not fraud) of a non-serving validator's bond. A penalty MUST be re-derived from the live validator set (never stale-slashing a rotated-out provider).

• R5.3c - Protocol DA duty. Protocol-evidence and leased-model DA under this section are validator duties, funded from the validator share of block rewards + fees; these duties MUST NOT charge per-byte storage or retrieval fees. Serve-or-slash enforces the funded duty. Paid application objects MUST use the separate contract in §5.4.

• R5.3d - Retention classes. Ephemeral (≥ challenge window, then prunable) covers quotes/proofs/transcripts/I-O - no charge, spam-bounded because such blobs are creatable only through fee-bearing flows. Leased covers model weights + dm-verity images - a fixed term with no storage fee but a refundable anti-spam deposit (bytes × da_lease_deposit_per_byte, held under a dedicated hold reason, returned in full on prune or withdrawal - never revenue), extendable by anyone for free (top_up_lease, tx fee only), pruned only after lease_end + grace (14 d). For both retention classes, pruning MUST reject a blob while any consumer holds a usage pin (pin_count > 0); a pin MUST NOT extend the retention deadline or permit new usage after expiry. Pruning MUST be recoverable: the dm-verity root is deterministic, so re-upload reproduces the same commitment and identity (MeasuredRoots) survives.

• R5.3f - Lease withdrawal. The publisher, and no other account, MAY call withdraw_lease(commitment) for a Leased blob. The call MUST reject an unknown or non-leased blob, a signer other than the publisher, or any blob with pin_count > 0; eligibility MUST NOT depend on lease_end. For withdrawal purposes, a third-party top_up_lease MUST only extend the prune horizon: it MUST NOT bind the publisher to that horizon or entitle the extender to a refund. A successful withdrawal MUST remove the blob, so no further audit can be issued against it, and refund the full deposit to the publisher. Withdrawal does not by itself resolve an audit already issued against the blob; how such an audit resolves is open (E.47).

• R5.3e - Reorg-safe serving. The off-chain indexer MUST serve only heights inside the AlephBFT finalized prefix (a finalized block can never orphan), never the best tip.

• R5.3g - Session evidence allocation. Only the named miner of a funded Open channel MAY allocate Ephemeral evidence through the composing session pallet. Allocation MUST be bounded to one immutable activation slot per SLA turn and one final transcript. Activation bytes MUST NOT exceed the session activation cap; canonical FCC4 transcript bytes MUST NOT exceed 40 + 351 × SLA max_turns. An identical retry MUST verify the original publisher, size, retention class and unexpired registry binding without renewing expiry; a conflicting, expired or missing occupied-slot binding MUST reject. Registration MUST NOT satisfy TOPLOC, proof or payment gates. Publishers MUST establish finalized registration before assigned-provider upload and verify custody and reconstruction. After proof generation, retirement MUST recheck exact evidence bytes, current custody and natural retention through the full dispute horizon before settlement. Terminal channel closure MUST remove allocation bookkeeping without changing the DA retention contract.

Leasing supersedes an unbounded "persistent" tier - model relevance is 6-12 months. Moving the TEE quote off the miner's HTTP server removes miner-only custody. It does not make availability independent of the validator set: registration, an unexpired record, successful spot audits, and reconstructability over the full dispute lifecycle are distinct predicates. Serve-or-slash is an incentive conditional on audits and repair, not an unconditional availability guarantee (E.47).

Rationale & sources (non-normative)

Sizing target and sovereign-DA decision: D-0402 (sovereign validator DA), D-0412 (DA is a validator duty, no per-byte fee; supersedes the fee provisions of D-0402/D-0407), D-0407 (leased model storage). D-0521 extends the prune pin guard to Ephemeral blobs without extending their expiry. R5.3f combines D-0407's rule that in-use leases remain stored with D-0412's publisher withdrawal and full refundable-deposit rule. Full design da-sovereign-validator-design.md; sizing indexer-scaling.md, scaling-500k-agents.md, scaling-500m-1b-agents.md, r3-throughput-ceiling.md. Formal: FlopSpecs/DataAvailability.lean, FlopSpecs/DaProviderRotation.lean, FlopSpecs/IndexerReorgSafety.lean, da/da-retrievability.qnt. Review arithmetic and availability assumptions: prepublication-evidence.md. Provenance clarification: D-0501. Status: Appendix H.

5.4 Agent memory and paid data storage

Requirements

• R5.4a - Scope and chain footprint. Agents MAY store arbitrary application bytes, including memories, documents, datasets, and encrypted indexes, in a separate PaidObject namespace hosted by bonded validators. FLOP is not a storage chain: the chain MUST hold only per-epoch tariff and capacity state, one CapacityReservation per payer, per-provider epoch checkpoints, service lanes and accounting; object commitments, manifests and ordinary memory heads MUST live with the assigned provider group and reach the chain only through checkpoint roots and disputes. Protocol Ephemeral and model Leased duties MUST retain §5.3 pricing. General application uploads MUST NOT enter those subsidized classes through the paid-object API. Admission MUST authenticate the originating protocol/model flow and enforce its resource limits; a caller-supplied class or content-type label MUST NOT establish eligibility. A reservation MAY hold many namespaces, objects and memory heads; agents, sessions and sub-agents SHOULD operate inside one payer's reservation through delegated capabilities anchored in agent-wallet session-key limits, so on-chain state scales with payers, not with agents, sessions or objects.
• R5.4b - Confidentiality and authority. Clients MUST encrypt private content and its private manifest before erasure coding, using authenticated encryption with a fresh object key and unique nonces. Authentication MUST bind chain, namespace, object version, and chunk position. These encryption/key-generation obligations MUST be enforced by conforming clients; envelope admission MUST NOT be represented as proof that an arbitrary uploader encrypted securely or kept its key secret. Validators MUST check the versioned envelope's field bounds, declared suites, commitments, signatures, and authorization; they MUST NOT require plaintext or decryption keys. Without a separately specified proof, validators MUST NOT claim to verify AEAD tags, key entropy, or plaintext absence. Read, write, renew, delete, and payment authority MUST be separately scoped by owner-authorized capabilities bound to subject, namespace/object, operation, expiry, policy epoch, and limits. Each request MUST prove possession of the authorized subject key and bind its method, resource, body digest, and replay nonce. Delegation MUST NOT enlarge authority. Capability checks MUST use finalized policy state and fail closed when stale. Payment authorization MUST also satisfy agent-wallet/session-key aggregate spending limits.
• R5.4c - Integrity, memory heads and checkpoints. An object MUST be immutable and committed by ciphertext hash, encoded-shard commitments, ciphertext length, and codec/profile version. The private manifest MUST authenticate the plaintext interpretation and chunk layout. Each namespace MUST have a NamespaceManifest (objects, versions, tombstones and heads) sequenced by the assigned provider group: the provider first in the finalized assignment generation's order is the sequencer; a head update MUST be an owner-authorized compare-and-swap against the exact previous version, and a HeadReceipt MUST carry the E.54 head quorum of provider signatures over namespace, key, previous version, new version, object and sequence before a client treats the update as committed. Stale updates MUST fail. Updating a head MUST NOT delete a retained version. Two receipts signed by one provider for conflicting successors of the same version MUST be an objective equivocation fault. Every assigned provider MUST post one ProviderCheckpoint per epoch committing the manifest and head roots of every namespace it serves; a client MUST be able to obtain an inclusion proof, and a missing or conflicting checkpoint MUST be a fault after the E.54 grace window. Reading a head MUST need no lane or fee: it is a provider read verified against the receipt quorum and, when available, the latest checkpoint. An owner MAY instead pin a head on chain with set_memory_head; a chain-finalized head MUST be authoritative for that key over provider receipts. If the sequencer misses the E.54 response deadline, the next provider in generation order MUST take over, resuming from the highest quorum-receipted sequence. Clients MUST verify shard proofs, reconstructed ciphertext commitment, decryption authentication, and requested version before accepting data. Storage authenticity MUST NOT be represented as truth of the stored statements.
• R5.4d - Capacity, assignment and activation. Each epoch, an eligible validator MAY post a CapacityDeclaration of encoded bytes it will serve at that epoch's tariff, with the E.54 collateral reserved; the declaration MUST be its consent to assignment, and declared capacity and collateral MUST NOT be reused across simultaneous obligations. The funded unit MUST be a CapacityReservation binding a payer, unique nonce, reserved encoded bytes c_i per provider, term, tariff version, assignment generation, service profile and escrow. Assignment MUST be a protocol stake-weighted random sample among declarers with free capacity, drawn from finalized randomness after the open under E.47's anti-grinding and failure-domain profile; the payer MUST NOT choose or influence its providers. A reservation MUST become active, and rent MUST begin to accrue, when assignment is finalized; a payer whose open cannot be placed MUST fail closed with escrow returned. Each object write MUST target an active reservation with enough free reserved bytes for the object's full encoded footprint and MUST complete its own activation off chain: an object is readable once a reconstruction threshold of assigned providers has issued signed custody receipts for validated shards, and fully replicated once every assigned provider has; a receipt missing after the E.54 activation window MUST be that provider's fault and trigger repair at its cost. Missing custody, an invalid encoding, or an insufficient independent receipt set MUST fail the write. Receipt of shards alone MUST NOT start setup earnings. Pending uploads MUST reserve bounded ingress, validation work and concurrency before expensive work; aborted activation MUST NOT restore consumed resource budgets. A refundable setup allowance MUST NOT be treated as payment for failed-admission work.
• R5.4e - Epoch tariff. All service payments MUST transfer existing FLOP from the payer to validators performing the contracted service. Prices MUST come from one EpochTariff per epoch: a nonnegative rational rent rate p/q in base units per reserved encoded byte-block with q > 0, a one-time setup fee F in base units per object write per provider, a retrieval rate r/s per acknowledged encoded byte with s > 0, and a request fee f. The tariff MUST be the stake-weighted median of the votes of validators that also declared capacity for that epoch, clamped to the E.54 per-epoch step bound around the previous tariff and to any governance floor and ceiling; a validator that does not declare capacity MUST NOT vote. If declared free capacity has stayed below the E.54 demand headroom for the E.54 number of consecutive epochs, the tariff MUST step up by the bound regardless of votes; with no declarers the epoch MUST admit no new reservations. Reservation escrow MUST equal C_rent = Σ_s ceil(c_s × T × p / q) at the open epoch's tariff within the payer's signed cap; each write MUST be funded with F per assigned provider, so C_store = C_rent + Σ_writes n × F. An object's encryption/coding padding MUST count toward the reserved bytes it occupies, and the profile MUST disclose the encoding and reconstruction threshold. F MAY be zero; it MUST cover all one-time ingest/activation work for one write. Scheduled audits, repair, checkpoints and bounded terminal retention MUST be included in rent. Rent MUST accrue on reserved bytes whether or not they are occupied. A reservation's rates MUST stay fixed for its term; extension MUST use the tariff of the epoch in which it is funded and MUST NOT silently repeat setup charges. Each extension MUST fund a separate tranche within its signed payer cap. For slot s with c_s reserved bytes, tranche k covering term positions [S_k, S_k + L_k) at p_k/q_k MUST hold B_sk = ceil(c_s × L_k × p_k / q_k); tranches MUST NOT overlap. Monetary products, ceilings, sums and differences MUST use checked arithmetic and fail closed on overflow, underflow or a zero denominator. Settlement MUST NOT require a token-price oracle. Voting MUST NOT be represented as proof of truthful costs or sufficient capacity; voluntary capacity declaration and the step rule are the clearing mechanism. Tariff selection MUST NOT relax R5.4d's placement, capacity, or collateral conditions.
• R5.4f - Earnings and conservation. Rent MUST be released from escrow by the chain per epoch, without a provider claim, to each assigned provider whose audit and checkpoint state for that epoch is accepted under the E.54 profile. Each slot and funding tranche MUST use one position-indexed accumulator R_sk(τ) = ceil(c_s × (τ − S_k) × p_k / q_k) for S_k ≤ τ ≤ S_k + L_k. An accepted interval [a,b) within that tranche MUST earn its historical slot holder exactly R_sk(b) − R_sk(a); an interval crossing a tranche boundary MUST be split there and use each tranche's own tariff. Each position MUST be credited at most once. Rounding MUST NOT restart for an epoch, assignment segment or provider identity; the index MUST be the position in the contracted term, never the number of accepted blocks. Replacement MUST preserve the slot/tranche accumulators and the replaced provider's earned-but-unreleased entitlement to its own positions, subject to R5.4j forfeiture; it MUST NOT transfer that entitlement or earlier failed positions to the replacement. Failed, unserved or forfeited interval deltas MUST remain in escrow for refund to the payer at close. Unresolved intervals MUST NOT release rent; the E.54 challenge window MUST elapse before a release is final, and accrued-but-unreleased rent MUST remain forfeitable under R5.4j. Per-slot paid + held MUST NOT exceed Σ_k B_sk, where held is outstanding rent reserved for accepted or unresolved historical intervals. Close MUST settle surviving entitlements before refunding Σ_k B_sk − paid − held per slot; it MUST NOT refund a live hold. Repair MUST NOT increase the payer's cap. A setup fee MUST be paid through the payer's ServiceLane voucher (R5.4g) at most once per write, provider and object, and MUST become earned only after the write's activation receipts and challenge window; failed or timed-out activation MUST refund it. Voluntary deletion after valid activation MUST NOT refund earned setup work. Repair/handoff MUST NOT repeat a setup fee. A reservation MUST be take-or-pay: voluntary object deletion is a manifest tombstone that MUST NOT refund, settle, or change rent; it frees the object's encoded bytes for later writes within the same reservation and term. A payer MAY transfer a reservation's remaining term and free capacity to another payer by signed consent under the E.54 transfer profile; a transfer MUST preserve the provider set, rates, assignment history and historical liability, and MUST NOT trigger any refund or repeat any setup fee. Provider-fault termination MUST NOT be relabelled voluntary deletion; disputed amounts MUST stay reserved for E.54 adjudication. Failed activation and unprovided service MUST retain their separate remedies. Each reservation and lane escrow MUST conserve funded = paid_to_validators + refunded_to_payer + remaining_escrow. Refundable metadata deposits and validator collateral MUST use separate holds; neither is service revenue. Transaction fees MUST be accounted separately under §9. Service transfers MUST NOT mint rewards or automatically count toward inference rewards or committee-duty credit.
• R5.4g - Service lanes and settlement. A payer MUST fund one ServiceLane per assigned provider before paid writes or transfers; the lane pays setup fees and retrieval and MUST be shared by every namespace, session and delegated capability under the reservation. Purchase of storage MUST NOT authorize unlimited reads. Ordinary retrieval MUST be authenticated direct pull, without caller-directed forwarding, recipient lists or validator broadcast. A lane MUST pin the tariff version of its funding epoch for its cumulative counters; a tariff change MUST apply only to lanes funded afterwards, with the prior lane's claims preserved. W_i MUST count activated writes, B_i MUST sum bytes acknowledged once per request nonce/range (a fresh authorized request for the same range adds its bytes again), and N_i counts acknowledged requests. The cumulative amount MUST be A_i = W_i × F + ceil(B_i × r / s) + N_i × f. The request fee MUST be advanced: the voucher that increments N_i and its fee MUST accompany the request, before the provider sends that request's first chunk, and a provider MAY refuse to serve a request without it; bytes then accrue as chunks are acknowledged. Payer-signed cumulative vouchers MUST bind the lane, sequence, object/version, acknowledged range commitment, counters and amount. Only the lane's provider, directly or through an authorized proxy dispatching as that provider, MAY submit redemption. Redemption MUST require a sequence strictly above the last redeemed sequence, every cumulative counter at least its last redeemed value, an amount equal to the formula at the pinned tariff, and already_paid_i < A_i ≤ budget_i. It MUST pay only A_i − already_paid_i to that fixed provider, after checking signatures, domain/version, capability/spending authorization, and lane budget; provider reassignment MUST NOT invalidate a claim. A provider MUST serve only against a voucher that dominates the last one it accepted, and SHOULD redeem at most once per epoch per lane. The chain MUST assign lane identifiers from per-payer nonces that MUST NOT be reused, including after finalization or pruning. Lane budgets MUST NOT collectively exceed escrow. Replay, stale counters, overflow, wrong payee, or conflicting domain/version MUST fail closed. Validator logs alone MUST NOT authorize a debit.
• R5.4h - Bounded transfer risk. The client MUST authenticate a chunk before acknowledging it; the provider MUST cap unacknowledged bytes and stop on missing payment acknowledgement. Retries for an already acknowledged range under the same request MUST NOT increase its bill; a fresh request MUST obtain fresh payer authorization. Failed/corrupt/unacknowledged chunks MUST NOT be charged. Each request MUST have bounded retry bytes/count, deadline and concurrency; exhaustion MUST stop transfer and require fresh paid authorization and admission. Billing deduplication MUST NOT authorize unlimited redelivery. Every attempted disk/CPU operation and transmitted byte, including framing, retries and unacknowledged data, MUST consume its service resource budget. Before work, providers MUST atomically reserve request/IO/egress/concurrency and unpaid-credit capacity across lanes, delegated keys and connections, with aggregate payer and provider-wide ceilings. Refunds, fresh identities/requests/lanes and restarts MUST NOT reset provider-wide consumed budgets; replenishment MUST follow a bounded monotonic-time policy independent of finalized-block billing. Delegated budgets MUST share the parent allowance. These bounds MUST survive restart or fail closed. Per-account limits MUST NOT be claimed Sybil-resistant, nor provider fees a coalition-external traffic tax. The protocol MUST NOT claim atomic fair exchange: withheld acknowledgements consume the bounded unpaid exposure, which per request MUST NOT exceed the unacknowledged-chunk cap at the lane rate less the advanced request fee; the advanced fee is the payer's symmetric bounded exposure to a non-serving provider. Failed reads MAY trigger a separate objective availability challenge; a reader's accusation alone MUST NOT slash a validator.
• R5.4i - Service security. Paid ingress, reads, and repair MUST authenticate the appropriate owner/reader/assigned-peer authority before expensive work. Unauthenticated parsing/handshakes and signature checks MUST have separate bounded work and memory admission. Public proof reads, legacy routes and caches MUST NOT become a bypass for paid-object reads. Repair authority MUST bind a unique job, finalized assignment generation, object, authenticated destination, byte/work bound and deadline; duplicate jobs and retries MUST consume the same bounded reserve. An assigned peer MUST NOT gain arbitrary paid-object access. Audit openings MUST be bounded by their challenge, without arbitrary-range retrieval privileges. Validators MUST isolate paid capacity and traffic from consensus, protocol evidence, and audit/repair reserves. Audits MUST bind unpredictable post-commit challenges to committed shard data and assignment history; publishing an expected response and accepting its echo MUST NOT establish custody or earnings. Audit sampling MUST satisfy, per provider and epoch, p_a × c_r ≥ c_s, where p_a is the per-epoch probability that a held shard is challenged, c_s is that provider's rent share for the epoch, and c_r is the cost of re-fetching a reconstructing shard set at the epoch tariff's retrieval rate and request fee; c_r MUST be evaluated under E.47's independence premise and MUST NOT be credited where assigned peers may collude. Audit sampling, selective-serving defenses, objective adjudication, repair deadlines, correlated-loss limits, and terminal compensation MUST otherwise follow the activation profile in E.54 and E.47.
• R5.4j - Rotation, revocation, and termination. Paid obligations and collateral MUST remain attributable to the validator assigned during the challenged interval until handoff and liability expiry, including after validator-set exit. Replacements MUST NOT inherit another provider's fault. Forfeitable value MUST include accrued but unreleased rent held back through the challenge window; the E.54 bond profile MAY net required explicit collateral against that held-back amount, and held-back rent MUST remain forfeitable through the liability window. Equivocation on a head or checkpoint, a missing checkpoint after grace, and a failed audit MUST be objective faults with E.54 dispositions. Revocation MUST deny new requests at the new finalized policy epoch, while preserving vouchers valid under the funded lane's close and claim rules. A lane's close boundary MUST be the block including the payer's close, or the reservation's end if earlier, and MUST NOT move once set, including on repeated close, revocation or provider rotation. Closing MUST stop new funding and preserve the lane's reservation-provider slot and escrow until finalization. The claim deadline MUST be that boundary plus the profile's pinned lane_claim_window_blocks, a nonzero number of blocks at least one paid-storage epoch, fixed at funding. A Closing lane MUST redeem only at a known finalized height at or below the deadline, and MUST finalize only at a known finalized height strictly above it; an unknown finalized height MUST reject both operations. A finality stall MUST freeze the deadline clock; catch-up MAY cross the deadline at once, so the window MUST NOT be promised after recovery. Settlement MUST accept otherwise-valid vouchers through the deadline regardless of whether they were signed before or after close. Once close is finalized, conforming payers and delegates MUST stop signing for the lane and conforming providers MUST stop admitting new requests. Close MUST NOT be represented as proof of signing time. Already committed lane funds MUST remain reserved up to the signed cap until the claim deadline; the payer's post-close exposure is the lane's unspent budget, and revocation MUST NOT promise immediate cancellation of it. Finalization MUST refund exactly that remaining escrow. Reservation termination MUST NOT release funds still allocated to a lane. Owner deletion of an object MUST tombstone it in the manifest, stop new ordinary reads, and free the object's reserved bytes at the next checkpoint boundary; it MUST NOT change rent accrual. Reservation expiry MUST stop accrual and new ordinary reads at term end. Bounded in-flight reads, audits, and repair MUST obey their funded deadlines; paid pins MUST NOT extend retention indefinitely. After outstanding claims/challenges close, the protocol MUST settle fault remedies according to the termination cause, refund unused lane budgets, release eligible holds, and authorize prune. Every terminal path, including ordinary expiry, MUST settle all valid entitlements and return unallocated escrow (including unused replacement-budget savings) to the payer; Closed/Aborted reservations MUST have zero remaining escrow. Such a surplus MUST NOT include funds still subject to claims. Unrecoverable loss MUST enter this failure/compensation path without claiming that a refund restores the data. Clients MUST distinguish deletion/key revocation from erasure of copies already obtained by a reader or validator. Pricing MUST NOT be claimed to prevent redistribution of acquired copies outside the service. The service MUST NOT promise hidden sizes, timing, ownership links, or access patterns.
• R5.4k - Activation gate. Paid storage MUST remain disabled until E.54's encoding, cryptographic, accounting, economic, and service limits are ratified and implemented, and E.47's placement/repair premises are demonstrated for that profile. Unknown profile versions MUST fail closed. R5.4q defines the only exception.
• R5.4q - Development-network exception. A development network (devnet) whose token carries no value MAY carry the extension before E.54 only if its runtime is built with a non-default, development-only build flag that no testnet or mainnet runtime, chain spec, or runtime upgrade enables; a runtime built without that flag MUST NOT contain any part of the extension. On such a network the active profile MUST carry an explicit unratified-development version, its placeholder values MUST be marked unratified and MUST NOT enter the canonical parameter set, and every call and hook MUST still reject an absent or unknown profile (R5.4p). R5.4f's audit-acceptance condition MAY be replaced by an explicit unaudited marker on each release. Results observed on such a network MUST NOT be cited as E.54 or E.47 evidence or as an availability, pricing, compensation, or conformance claim.

Data structures

• R5.4l - Data structures. The logical EpochTariff, CapacityDeclaration, CapacityReservation, ServiceLane, ProviderCheckpoint, NamespaceManifest, PaidObject, HeadReceipt, capabilities and vouchers MUST follow Appendix F.7. DataRef v1's 34-byte encoding and retention tags MUST NOT be reinterpreted as paid reservations or objects.

Interfaces

• R5.4m - Interfaces. On-chain lifecycle and settlement interfaces MUST follow Appendix G.4. Off-chain clients MUST support tariff and capacity lookup, reservation open/extend/transfer, lane funding, encrypted object write and delete against the provider group, authenticated range retrieval, head lookup/update with receipt verification, checkpoint inclusion proofs, and reservation status. A delegated capability MAY authorize a sub-agent or session to write within a bounded byte quota of the payer's reservation and to read within a bounded share of its lanes without holding funds of its own. Private semantic/vector search MAY run client-side over encrypted index objects. Server-side search or inference over decrypted memory MUST require a separately authorized compute/privacy contract.

State machine

• R5.4n - State machine. Reservation: Pending → Active → Closing → Closed; Pending → Aborted when placement fails; an assignment within an active reservation MAY be Repairing. Object (in the manifest): Staged → Readable → Replicated → Tombstoned, with Staged → Aborted; a tombstoned object frees its bytes at the next checkpoint boundary and never returns. Reservation activation MUST be the finalized assignment; object states MUST follow R5.4d; repair MUST suspend earnings for unproved intervals and either complete verified handoff within the existing budget/deadline or close with refunds. A replacement whose terms cannot fit the budget MUST NOT be accepted without a separately authorized extension. Pending reservations and staged objects MUST have a bounded expiry. Closing MUST preserve evidence until the bounded claim/challenge deadline; Closed/Aborted MUST reject new claims, new writes, and replayed activation.

Agent memory flow and cost model (non-normative)

The requirements above are written for implementers. This is the same mechanism read from an agent's side: what an agent can do with data, in what order, and what each step costs. Prices in the example are a calibration illustration at the reference band of agent-memory-storage-market.md; E.54 and #1565 set the launch tariff.

Flow.

1. Epoch pricing. Each validator that wants paid-storage work votes a tariff and declares the encoded bytes it will serve at the result (R5.4d, R5.4e). One tariff vector lands on chain per epoch.
2. Reserve, once per wallet per term. The payer opens a reservation with bytes, term and a max-cost cap; the chain draws the profile's provider count at random among declarers (six in this illustration) and escrows rent. There is no confirm round trip: the declaration was the consent.
3. Fund lanes. One service lane per assigned provider (R5.4g). The SDK default sizes the lanes to at least one full reconstructing read, refunded at close if unused.
4. Delegate. The wallet issues capabilities to agent session keys with a namespace, byte quota, lane share and expiry (R5.4b), anchored in agent-wallet spending limits. Sessions and sub-agents are capabilities, not reservations.
5. Write. The agent encrypts, encodes and uploads shards with a cumulative voucher; custody receipts from a reconstruction threshold make the object readable, from all assigned providers fully replicated (R5.4d). The commitment goes into the namespace manifest, not on chain.
6. Update and read heads. Compare-and-swap through the group sequencer returns a quorum receipt in one round trip; a head read is any provider's answer verified against that receipt and the latest checkpoint (R5.4c). Neither touches the chain or a lane.
7. Checkpoint. Each provider posts one root per epoch; agents can fetch inclusion proofs, and conflicting receipts are an objective fault (R5.4c, R5.4j).
8. Read bodies, settle, close. Body reads pull chunks against advanced request fees; providers redeem vouchers about once an epoch; rent releases per epoch on the chain's schedule (R5.4f); finalize returns unused lane budgets (R5.4j).

Cost composition. A wallet pays chain transaction fees at open, lane funding, extension and close only. Writes cost the tariff's setup fee per provider. Body reads cost acknowledged bytes plus the request fee. Rent is prepaid on reserved bytes for the term. Head updates and head reads cost nothing. For agent memory the order of magnitude is therefore: chain fees at open, then per-write setup, then retrieval, then rent. Setup per write is the only line that scales with agent behaviour, which is why conforming SDKs batch small records into one object per compaction.

Illustration at a reference tariff (rent about 0.0167 FLOP per encoded GiB per 30 days, setup 0.002 FLOP per provider per write, retrieval about 0.0167 FLOP per served GiB, request fee 0.0001 FLOP; six providers, 3-of-6 coding, about 0.01 FLOP per extrinsic; not a rate):

A million typical agents pay validators on the order of 250,000 FLOP a month at that tariff, almost all of it setup fees: memory is an enabling service for the inference economy, not a revenue line.

Where it can inhibit agents, and what bounds it.

• No capacity at open. When declared capacity is exhausted a new reservation fails closed, a visible failure at open rather than a silent loss of stored data; the R5.4e tripwire raises the tariff until capacity returns, and existing reservations are untouched.
• Renewal price steps. Bounded by the per-epoch step and governance band (R5.4e); a wallet can also take over a cheaper term by transfer (R5.4f).
• Stale heads under collusion. A colluding majority of one provider group can serve a stale head until the next checkpoint and its E.54 grace window expose it, to a reader that verifies against checkpoints; critical state can be pinned on chain and a receipt conflict is a slashing proof (R5.4c, R5.4j).
• Sequencer outage. Head updates stall until the E.54 deadline, then failover follows generation order; reads never stall (R5.4c).
• No provider choice or tiers. One tariff, random placement. Profiles can be added under E.54 if demand appears; the grinding protection of R5.4d is the reason for the restriction.
• Funds and a wallet. An agent without FLOP cannot open a reservation, but it can write and read under a capability from an operator wallet, which is the intended shape for fleets.

Rationale & sources (non-normative)

D-0506 narrows D-0412's no-fee rule only for paid application objects; D-0512 scopes its activation gate to admit an unratified profile on development networks (R5.4q). D-0519 defines the fixed lane-close boundary, finalized-prefix claim deadline, bounded post-close exposure and provider-only redemption. D-0524 supersedes per-provider cumulative ceilings with slot/tranche position deltas, preserving historical entitlements and refunding failed or forfeited deltas to the payer. Its seven regression vectors are the implementation handoff for rent settlement and the money-path corpus. Design, pricing examples, threat assumptions, and validation plan: agent-memory-storage-market.md and the economics and traffic review; the agent-facing flow and cost guide is docs/storage/agent-memory.md. Existing placement and availability limits remain in da-sovereign-validator-design.md and prepublication-evidence.md. Implementation status: Appendix H.

Draft unbounded accounting, authority and historical-liability contracts are scoped in paid-storage-proofs.md and the per-requirement attribution index. They assume authenticated event validation and explicit progress; they are not physical availability, deployed cipher security or implementation refinement. The c=1, T=2, p/q=1/2 replacement example exposes the superseded independent-provider rule: 2 owed against escrow 1. Under D-0524, A earns 1 for [0,1) and B earns 0 for [1,2), with zero refund after full service. Slot/tranche deltas conserve funding regardless of release order; every contiguous interval within a tranche differs from its exact rational share by strictly less than one base unit. The contracts are not yet composed into the system capstone.

---

6. Base-Layer Primitives & Agent Autonomy

6.1 Primitives

FLOP's economic layer is account/nonce-based Substrate (zero UTXO). The available primitives:

Capacity-proportional miner self-stake (normative). Required miner self-stake MUST be linear in calibrated throughput with no cap (a cap makes the largest miners' inflation fraud +EV):

required_self_stake(B_p) = min_miner_self_stake + miner_capacity_stake_per_gflop · B_p

with min_miner_self_stake = 10,000 FLOP and miner_capacity_stake_per_gflop = 0.01 FLOP/(G_n/s). The coefficient guards emission-inflation fraud: the realized extra reward over the dispute window W for a miner claiming X·B_p is r·(X−1)·B_p·W (linear in B_p), so a constant k tracks the security floor k_min(EV) = ((1−p)/p)·(X−1)·P·W / B_total. The onboarding form of this bound is Appendix C.1.

R6.1a - Sponsored registration bonds. A sponsor MAY post the whole registration bond of a miner or validator and later top it up (Appendix G.3). The sponsored principal MUST stay owned by, and frozen in, the sponsor account: the operator MUST NOT be able to transfer it, pay fees with it, place it on hold or escrow, or back other stake with it. It MUST stay slashable while active or unbonding and MUST be refunded only to the sponsor, after the role's unbonding window has elapsed on the finalized prefix. Active sponsored principal MUST count toward the miner self-stake requirement above and toward the validator effective minimum (§15.2) only on runtimes built with sponsored_self_stake_enabled; on every other runtime it is backing only, and sponsored registration and top-up MUST be rejected. The slash-proceeds account MUST NOT post principal that counts as self-stake, since its slashes would pay it back; while it still holds a live sponsor position from before the rule, the runtime MUST NOT credit any sponsored principal. Because freezes overlap rather than add, on enabled runtimes sponsor principal MUST be the sponsor account's only staking freeze: an account holding own stake, a delegation or any staking freeze in the other staking pallet MUST NOT open or grow a sponsor position, and a sponsor account MUST NOT add own stake or a delegation in either staking pallet. When a running chain first enables the rule, every live position whose sponsor already holds another staking freeze MUST be quarantined, and no sponsored principal credited until that scan, which runs in bounded per-block batches, completes, nor while any quarantined position remains live. On enabled runtimes a registration, own or sponsored, MUST be rejected while sponsor positions from an earlier registration of the account are live, so a slash of the new registration never reaches sponsors of the old one; the operator MAY withdraw such a position after its finalized unlock, and MAY start the full unbond of one that outlived its registration. On enabled runtimes a jailed validator MUST NOT return to the active set below the effective minimum: un_jail, like rejoin, first restores its bonded self-stake from its own spare balance. On enabled runtimes a sponsor unbond that takes an active validator below the effective minimum MUST return it to the queue, and MUST be rejected where that would cross the minimum active set. On enabled runtimes an operator's deregistration MUST start the unbonding of its active sponsor positions. The validator self-stake ratio for native delegation MUST count operator-owned stake only. Chain state and events MUST report own and sponsored stake separately; a sponsored bond creates no allocation right (R8.4).

6.2 Agent autonomy - operating without per-action consensus

pallet_session_keys + pallet_agent_wallet let an owner pre-authorize a delegate agent with a lifetime cap, per-tx and daily caps, a pallet/destination allowlist, and a circuit breaker (circuit_breaker_window / circuit_breaker_tx_count / circuit_breaker_flop_cap). The session-key lifetime MUST be ≤ 864,000 blocks (SessionKeysMaxDuration). This is approximately 10 elapsed days only at uninterrupted 1 s target cadence; missed or delayed blocks extend the elapsed lifetime. Each wallet's daily cap is chosen at create_wallet; agent_daily_cap_autonomous is a simulator scenario value, not a runtime-wide cap.

• R6.2a. Within its bounds, a delegate MUST be able to act with no per-action consensus - only deterministic on-chain checks - so agents run unattended, submitting asynchronously; validators order.
• R6.2b. The owner MUST be able to revoke at any time. Spending MUST be blocked at the session cap (§11 INV-02), the daily cap, and the circuit breaker; a captured session key MUST be bounded by these caps. The wallet and session daily budgets MUST reset on the first spend at or after agent_cap_window_blocks (86,400 blocks) from wallet or session creation, or from the previous reset. That spend starts the next window; this reset does not use the BABE epoch boundary.
• R6.2c - Circuit breaker. The breaker window is per delegate and shared across its sessions: it opens at the delegate's first create_session, and once elapsed the next window opens at the delegate's next transaction. Its transaction-count and spend limbs trip independently; either trip MUST latch rejection of every delegate transaction until the window ends and auto-resets, and Root MAY reset it earlier via force_reset_circuit_breaker (pallets/pallets/session-keys/src/lib.rs::{check_and_update_circuit_breaker,is_circuit_breaker_tripped}).

6.3 Transaction / state model

FLOP retains the account model; going fully UTXO-native is ratified as not adopted.

• Cross-agent parallelism is free - independent agents touch disjoint accounts; the BFT-DAG orders their concurrent blocks.
• Intra-agent txs use one monotonic u32 account nonce. The runtime admits consecutive nonces from one account within a block (pallets/runtime/zkverify/src/lib.rs::SignedExtra uses frame_system::CheckNonce<Runtime>); single-lane in-flight limits are client policy. Implementations SHOULD give each agent its own account (via agent-wallet) so the nonce serializes only its own stream, and MAY add 2-D / parallel nonces (multiple lanes per account) to remove head-of-line blocking; 2-D lanes are not adopted. Sessions largely moot this (§12.1): a streaming session touches the chain only at OPEN/SETTLE.

A UTXO payment side-rail remains an option for a pure high-frequency micropayment hot path; it is not a second state model.

6.4 Collaborative pool & composition

The escrow primitive ("pool funds and collaborate") has landed as pallet_compute_channel (§12.1): a two-party (agent↔miner) escrow whose payout is conditioned on a settlement/dispute verdict, with mandatory timeout-refund and conservation of each escrow inflow across net miner payouts, buyer refunds, burns or routed penalties, cumulative audit earmarks, and funds still held for unsettled channels. Cumulative audit earmarks include both paid audit fees and the unspent audit reserve; adding audit fees again would double-count that allocation. The forward bond is a separate source of funds and has its own conservation ledger. This is the generalizable escrow primitive.

• R6.4a. An escrow MUST conserve funds, pay out only on quorum/verdict or timeout-refund, account per-participant, and never let a single party withdraw the pool.

The N-party generalization (shared funds, programmable quorum split) and the MPP fan-out of one session across miners are future work; until then compose multisig + treasury or 1:1 HTLC. The wider composition target is three declarative, bounded, conservation-safe layers: composable spend conditions (Miniscript-style - delivered), attenuable capabilities (UCAN/macaroon-style, generalizing §6.2 session keys - future), and a terminating multi-party escrow (Marlowe-style - the primitive above).

6.5 Cryptographic primitives & accounts

The primitives every other section relies on, pinned in one place. Consensus-critical: a change here is an encoding/soundness change (§14.1).

Accounts.

• R6.5a. An account is a 32-byte AccountId, SS58-encoded for display under the chain's SS58Prefix (42 on every FLOP network, R9.8). Extrinsics address accounts via MultiAddress<AccountId, ()>. Networks are told apart by genesis hash, not by address encoding, so an off-chain statement that authorizes value (such as a genesis claim statement) MUST bind the network by genesis hash or chain id.
• R6.5b. An account MUST hold ≥ the existential deposit (EXISTENTIAL_DEPOSIT = 0.01 FLOP) or be reaped. Balances carry 18 decimals and are integer counts of the 10⁻¹⁸ FLOP base unit.
• R6.5c. Intra-account transactions serialize on a monotonic u32 nonce (§6.3); a delegate agent SHOULD hold its own account so its nonce stream is independent. The runtime MUST admit consecutive nonces of one account within a block; a single-lane in-flight limit is client policy, not a runtime constraint (frame_system::CheckNonce<Runtime>).

Signature schemes. The runtime signature type is MultiSignature (signer MultiSigner), admitting sr25519, ed25519, and ecdsa/secp256k1. Usage by role is fixed:

• R6.5d. Post-quantum resistance is out of scope (§12.4): a scalable quantum adversary breaks sr25519/ed25519/secp256k1 (Shor) and halves SHA-256 preimage security (Grover). The boundary is explicit, not silent.

Hash functions. Each is fixed to its role; do not substitute:

• R6.5e - Domain separation. A signed or hashed payload MUST be domain-separated so a signature or commitment from one context cannot be replayed in another: the transcript leaf binds channel_id ‖ turn_index (§12.1b), task_hash v1 opens with the "FLOP/POUI/TASK" tag, a version byte and genesis_hash before its fields (App. F.1), and report_data binds the full (task_hash, gn_weight, …, tee_type) tuple (§3.3).

Rationale & sources (non-normative)

Provenance: D-0513 (SS58 prefix 42 on every network; networks told apart by genesis hash, R6.5a), D-0408 (single validator-staking system), D-0413 (value-coupled stake floor), D-0416 (stake-ordered rotation), D-0417 (declarative spend-condition layer, UTXO not adopted), D-0418 (capacity-proportional miner stake, provisional pending sim calibration), D-0403 (sessions as the escrow primitive's first instance), D-0530 (operator self-stake only; deprecation of delegation and commissions; 5% duration-locked community staking pool). Grounding: agent-composition-primitives.md, agent-token-lifecycle.md, model-selection-pricing-inference.md, miner-capacity-stake-calibration.md. The R6.2c latch and reset paths have a bounded model in session-circuit-breaker.qnt. An enclosing atomic batch that fails after the tripping call rolls the latch back with it; this is accepted, since the over-limit call never executes either way and a delegate gains nothing it could not get by staying under the limits. Prior art: Miniscript, Simplicity, Clarity, Marlowe, Move resources, UCAN. Status: Appendix H.

---

7. Hardware Calibration & Drift

C_ceiling = Σ_s n_s C_sku(s)
C_emp   (miner-proposed; accepted iff floor(C_emp · Δblocks · u_min / 10⁶) ≤ Σ G_job)
C_hard = min(C_emp, floor(C_ceiling · d_hard / 10⁶))
C_effective ≔ C_emp                                                (SOFT)
              min(C_hard, floor(C_ceiling_current · d_hard / 10⁶)) (HARD)

Σ G_job is verified reference work in whole G_n; Δblocks measures seconds at the 1s block timebase, so C_emp, C_ceiling, and C_effective are rates in G_n/s. The accepted cap also produces B_p = C_effective · 86,400 in G_n/day for work vesting. The miner-staking adapter divides B_p by 86,400 s/day before applying its capacity-stake coefficient; PoUI and session credit gates read the instantaneous C_effective rate. The existing direct PoUI gate compares a per-proof work count to this rate without a duration factor; its dimensional discrepancy is recorded in the unit audit for #1597. Here u_min ≔ calibration_min_utilization_ppm and d_hard ≔ calibration_provisional_discount_ppm. C_effective is the activated cap. C_hard is the stored HARD-tier cap; on renewal, the current governed inventory ceiling may tighten it but cannot raise it. The miner proposes C_emp; the work gate floors the requirement before comparing and accepts any cap the burst covers. It does not require the largest such cap, so a lower claim is accepted (the M13 calibration-sandbagging gap).

7.1 Entry - benchmark burst

R7.1. A miner MAY enter after a chain-timed burst of independently issued, correctness-verified calibration jobs. Each credential MUST bind miner, task hash, expected work, issue/resolution blocks, pack ID, and output commitment; it MUST have been issued no earlier than the claimed burst start and MUST be consumed once.

R7.1a. accept_benchmark_burst MUST fail closed on: zero cap; fewer than calibration_min_verified_jobs; a window shorter than calibration_min_burst_blocks; stale/unverified credentials; verified work below floor(C_emp · Δblocks · u_min / 10⁶) (the empirical cap, not C_effective); insufficient capacity-proportional self-stake for C_effective; or an initial cap accepted within calibration_min_recalibration_interval_blocks. The capacity deposit MUST be present before cap activation.

• SOFT tier - with no attested GPU inventory; the cap is bounded by empirical work, capacity stake, and carries the surge multiplier + spot-check exposure (soft_tier_spot_check_rate_ppm).
• HARD tier - attestation binds up to calibration_max_gpu_inventory_entries distinct (SKU,count) entries. The host ceiling is the sum of per-device governed ceilings, discounted by calibration_provisional_discount_ppm, then bounded by empirical throughput. R7.1b. An attested inventory with any missing governed SKU ceiling MUST fail closed and MUST NOT downgrade to SOFT. Inventory entries MUST be canonicalized by SKU.

R7.1c. Calibration is per miner host. C_emp includes all attached GPUs and production batching/concurrency once; it MUST NOT be multiplied by GPU count, channel count, session count, or batch size.

The SOFT tier is the non-TEE path (§3.2, R3.2); its end-to-end settlement/dispute policy is E.33.

7.2 Renewable cap

R7.2. An accepted cap is a lease of calibration_lease_blocks. At the exact expiry boundary every registration, PoUI, stake/vesting, and compute-channel consumer MUST fail closed. renew_benchmark_cap requires at least calibration_renewal_min_verified_jobs fresh one-shot jobs issued at or after a miner-declared renewal trigger. That trigger MUST NOT be in the future or older than calibration_renewal_max_age_blocks. Their aggregate verified work MUST cover floor(C_effective × max(1, current_block − renewal_trigger) × u_min / 10⁶). Job count alone MUST NOT renew a cap. Each successful renewal MUST NOT increase either empirical or effective capacity relative to the values stored immediately before that renewal. A later increase in the governed SKU ceiling does not restore capacity lost at an earlier renewal; a capacity increase requires a new initial acceptance under §7.1.

The accepted effective cap MUST remain frozen for its lease. A governed SKU-ceiling change MUST NOT silently alter or disable an already accepted cap. The changed ceiling applies at the next versioned renewal or initial acceptance, where it may only tighten renewal capacity.

The fixed three-phase Dyno is removed. There is no alternate legacy cap or governance force-finalize path. Long-window statistical degradation/downshift remains E.22; until then renewal proves continued correct execution, liveness, and minimum short-window throughput but does not raise or statistically re-estimate the cap.

7.3 Drift & re-calibration

Drift detection builds on canary tasks (fixed-seed, known-answer) via the Synthetic Task Engine, checking correctness (catches SDC and precision-cheating - INT4 changes outputs at equal op-count) and timing (throttling). The correctness canary itself is live (§8.1); the statistical layer - EWMA baseline + control charts → re-calibration on breach, and an MLPerf plausibility ceiling - is designed (E.22).

R7.3. The miner supervisor MUST request renewal after every process/host restart and chain reconnect, and when one day remains on the lease. An expired unchanged host MAY recover with the renewal pack. When (SKU,count) inventory or the device/driver/firmware fingerprint changes, the prior cap MUST be invalidated and a new §7.1 burst MUST complete. Missed renewal canaries expire the cap. Open sessions retain their snapshotted cap/version as an upper bound; a later versioned renewal may tighten settlement, and new sessions use the latest calibration_version.

The independent Ghost issuer MUST maintain a calibration reserve independently of organic demand: 64 jobs for a host without a stored cap and eight for a host with one. Miner-triggered acceptance does not authorize miner-chosen work. Initial replacement is throttled; renewal is not, because it consumes fresh credentials and cannot increase capacity.

Drift and cheating MUST be distinguished by signature: drift is slow, monotonic, temperature-correlated, outputs correct; cheating is a step change, wrong outputs, or throughput above the attested ceiling. Latency adjustment: Adjusted_G_n = G_n · clamp(target/actual, 0.5, 1.5) (tracked; reward weighting is E.22).

Rationale & sources (non-normative)

Provenance: D-0405 (measured G_n), D-0418 (capacity stake), D-0433 (quick entry, renewable cap, lifecycle revalidation). Runtime alignment: hw-calibration::{accept_benchmark_burst,effective_cap,discounted_cap,renew_benchmark_cap} uses the empirical cap for the initial work gate and the tier-dependent effective cap for bonding and renewal. At the governed floors, 64 jobs × 1,000 G over 600 blocks admit at most C_emp = 213; required work is 63,900 G, so 64,000 G passes. Priced miner BOM: validator-miner-hardware-costs.md, gn-unit-audit.md. SDC/drift detector literature: arXiv:2502.12340, arXiv:2605.04213, arXiv:2604.10390. Formal: FlopSpecs/CalibrationFastPath.lean, FlopSpecs/CalibrationDrift.lean, FlopSpecs/Calibration.lean. Open: E.22 (statistical degradation, cache-aware metering, aggregate multi-channel reservation, MLPerf data). Status: Appendix H.

---

8. Performance-Locked Vesting

R_p ≔ min(G_n_actual / B_p, 1) ∈ [0, 1]
UnlockRate = R_p²                                  (R_p = 0.5 → unlock 0.25)
Blackout:  capacity < 10% for blackout_revoke_blocks continuous blocks  →  grant revoked (1.0× slash)

• R8.1. A work-vesting grant created by create_grant MUST take as B_p its non-zero finalized §7 calibration baseline, snapshotted at grant creation; the Root-only force_create_grant bypasses that check and takes any non-zero caller-supplied baseline (Appendix H). Its pledge ratio MUST be clamped at 1 before squaring, so R_p ≔ min(G_n_actual / B_p, 1) ∈ [0, 1]; the unlock rate MUST be the convex R_p² (underperformance is penalized super-linearly; R_p² ≤ R_p).
• R8.2. A continuous capacity blackout below 10% for blackout_revoke_blocks MUST revoke the grant (1.0× slash).

8.1 Synthetic Task Engine (Ghost Tasks)

For a HARD-tier miner, the Validator Leader injects encrypted "Ghost Tasks" sealed to the miner's TEE key. They are intended to be indistinguishable from real tasks before execution, so the attested hardware must stay operational (also the HARD-tier anti-time-slicing mechanism, §2.4, and correctness canary, §7). A SOFT miner has no TEE key; its challenge delivery, identity binding, and demand-floor eligibility are part of the unresolved SOFT profile (E.33), so the sealed-task guarantee does not apply to that tier.

• R8.1a. Ghost Tasks are fixed-seed / known-answer. An incorrect result MUST complete nothing and apply a bounded escrow slash (OnGhostTaskFailed) - deliberately not the PoUI 100%-slash + blacklist fraud path, so transient drift is not treated as fraud. A correct result completes the task; a missed deadline expires it.
• R8.1b. Failed Ghost Tasks MUST burn/re-route the vesting tokens they gate.

Encrypted issuance, demand-floor auto-injection, and the known-answer correctness canary are the engine's core; statistical drift-vs-cheat discrimination and canary-triggered re-calibration are §7 / E.22.

8.2 Era-T conversion and airdrop vesting

Requirements

• R8.3 - Conversion supply. Era-T activity MUST distribute only the existing genesis_supply: conversion MUST NOT create incremental emission or fund an allocation twice. Each miner, validator, and agent allocation MUST draw only from its respective genesis_miner_airdrop, genesis_validator_airdrop, or genesis_agent_airdrop pool; cohorts MUST NOT cross-subsidize. The genesis_reserve is not an Era-T airdrop pool.
• R8.4 - Conversion eligibility. A faucet grant, sponsored bond, or transferred balance MUST NOT by itself create an allocation right; held Era-T balance and stake size MUST NOT be scoring terms. Agent scoring MUST derive from settled compute-channel spend and Miner scoring from PoUI-verified effective-FLOP served; completed job count and active days MUST NOT be scoring terms. A fraud-flagged account MUST receive zero allocation unless its flag is overturned before the genesis specification is locked; it MUST NOT receive partial credit while flagged.
• R8.5 - Snapshot. Conversion MUST use Era-T activity no later than a governance-ratified, finalized snapshot height. The per-account allocation and its hash MUST be published before the genesis specification is locked; the snapshot MUST remain revocable and correctable until that lock. The snapshot MUST identify each account's cohort, activity, fraud flag, and cluster identity; the published allocation MUST bind the inputs used to filter and score each account. The finalized Era-T chain state, allocation file, conversion-parameters file, and their hashes MUST form the evidence of record.
• R8.6 - Grant landing. An Era-0 airdrop allocation MUST enter as a funded genesis balance frozen by a pallet_airdrop_vesting grant; creating the grant MUST NOT mint the same allocation again. The grant tier MUST be Miner, Validator, or Agent, matching the account's allocation cohort.
• R8.7 - Unlock schedule. A Miner grant MUST unlock ⌊P/4⌋ of its principal P at its start block. The rest MUST unlock only against unlock credit: one FLOP of principal for each FLOP the grantee account receives from either of two sources. The first is its payout as the channel's miner of a compute-channel session settled by settle (R12.1a), by certificate-backed settlement of a CertificatePremium channel (certificate_settle), or by force_settle → finalize (R12.1d). A payout MUST count only once its settlement block is finalized and channel_dispute_window_blocks have passed since it with no upheld fraud dispute against the session (this payment-denominated airdrop unlock credit is governed by §8.2 and is distinct from public G_n work credit, reward accumulators, and work-vesting prohibited by §11.2 R11.2b). The second is its share of the miner leg of the block reward (miner_share_ppt, §9) as actually minted to the grantee account in a block-reward distribution. Such a share MUST count once the distribution block is finalized. Each receipt MUST count once. The validator, agent, and staker legs of the block reward, the Labs/Foundation subsidy, transaction fees and tips, forward-availability payments, refunds, penalties, and dispute bonds MUST NOT accrue credit. A Miner grant's unlocked amount is min(P − S, ⌊P/4⌋ + credit), where P is the grant's principal at creation, which never changes, and S is the total principal later slashed from it (R8.8); the grant has no end block, and principal not yet unlocked MUST stay frozen. A Validator grant MUST stay frozen until block halving_interval_blocks (63,072,000), the first block of halving era 1 (§9). From that block, Validator grants MUST be released one per 86,400 blocks (one day), each releasing its remaining principal P − S in full on its release block (where P is the grant's principal at creation and S is the total principal later slashed from it under R8.8; its unlocked amount is 0 before its release block and P − S from its release block onward), until every Validator grant is released; the window spans as many days as there are Validator grants. Until the release order is fixed (E.38), Validator grants MUST NOT be released. Releasing a grant lifts only its vesting freeze: it MUST NOT unbond stake, and a validator in the active set MUST keep at least validator_min_stake bonded (§15). Miner and Validator grants MUST NOT use a performance adjustment. An Agent grant MUST NOT unlock any principal at its start block, and it has no end block. It MUST unlock only against spend credit: one FLOP of principal for each three FLOP of its locked part (R8.8) in the payable (Appendix F.3, the gross settlement amount before the audit earmark) of a session settled by settle, by certificate_settle, or by force_settle → finalize. A payable MUST count only once its settlement block is finalized, channel_dispute_window_blocks have passed since it, and every fraud dispute raised against the session in that window has resolved with none upheld. Locked principal spent through agent_transfer, refunds, the R12.1d penalty, and any other leg outside the payable MUST NOT accrue credit. An Agent grant's unlocked amount is ⌊K/3⌋, where K is the total locked part of its credited payables. Its locked compute spend C, the principal drawn by the R8.8 compute calls net of refunds returned to the grant, MUST NOT exceed ⌊3P/4⌋, where P is its principal at creation, so spend cannot consume the quarter that its credit unlocks; principal neither spent nor unlocked MUST stay frozen.
• R8.8 - Claim and locked spend. claim_vested MUST use the finalized head to calculate the unlocked amount, subtract the amount already claimed, and release only a positive remainder from the grant freeze. Still-locked principal of an Agent grant MAY be spent only through agent_transfer, open_channel, top_up_escrow, and force_open for compute, within the R8.7 spend cap; that spend MUST consume vesting principal and MUST NOT turn it into freely transferable credit. Escrow a channel draws from locked principal, at opening or by top-up, is its locked part. At close the escrow MUST be allocated once, in this order: the payable draws on the locked part first; a refund then draws on what remains of the locked part first and returns that share to the grant as frozen principal, reducing its locked compute spend; every other leg draws on the remainder. Still-locked principal of a Miner grant MAY be bonded as that miner's own self-stake (§6.1), and still-locked principal of a Validator grant MAY be bonded as that validator's own self-stake (§15.2); in either case it stays frozen while bonded and after unbonding until it unlocks. Still-locked principal of a Miner or Validator grant MUST NOT otherwise be spent, transferred, or used for compute; slashing of bonded stake applies to it. Because stake and grant freezes overlap, a slash of a grantee's bonded stake MUST be charged first to the grant's still-frozen principal, up to the lesser of the slash and that principal, and only the remainder to other balance. The grant-charged part MUST be added to S and removed from the grant's freeze atomically with the slash, so the slash never fails on the grant freeze.

Data structures

An airdrop grant records its tier, its principal at creation, start block, and claimed amount. A Miner or Validator grant also records the total principal S slashed from it (and a Miner grant records its accrued unlock credit), an Agent grant its locked compute spend and accrued spend credit, and a channel the locked part of its escrow. The conversion snapshot records the ratified Era-T height, account cohort and activity, fraud and cluster filters, allocation, and a binding hash.

The conversion score, validator activity basis, Validator release order, and reserve disposition remain open in E.38.

Rationale & sources (non-normative)

Grounding: ghost-task-sampling-design.md (sampling, GhostTaskCommitment/MinerExecutionEvidence/CheckerVerdict, issuer/checker split + appeal), miner-capacity-stake-calibration.md. Genesis allocation and vesting: Era-T to Era-0 plan, SPEC-022 (the pallet's linear, performance-scaled curve, superseded for Miner and Validator grants by D-0517), locked compute spend; provenance: D-0421 (work-first allocation), D-0438 and D-0440 (current cohort pools), D-0514 (conversion supply, eligibility and scoring inputs, snapshot, and the fail-closed miner adjustment), D-0517 (the Miner quarter at genesis and earn-to-unlock credit, the Validator freeze to the first halving and daily release, and immobile locked Miner and Validator principal; it supersedes D-0514's miner adjustment and narrows D-0515's locked spend to Agent grants), D-0527 (Miner unlock credit for the grantee's minted miner-leg block rewards alongside its settled payouts; supersedes D-0517 item 1), D-0515 (grant landing, claims, and locked compute spend), D-0522 (Agent spend-to-unlock: one FLOP per three of locked principal in a settled payable, the three-quarter spend cap, and locked-first payout and refund attribution). Formal, for R8.1's work-vesting grant only: FlopSpecs/Vesting.lean (unlock_le_ratio, whose h1 : R_p ≤ 1 hypothesis is enforced by R8.1's clamp). Low-B_p calibration sandbagging remains M13's [GAP]. Status: Appendix H.

---

9. Emission & Supply

9.1 Requirements

• R9.1 - Block reward source. The per-block reward MUST be sourced from params/flop-protocol-params.yaml (initial_block_reward, mirrored to RewardInitialPerBlock), not hardcoded or per-second. It follows the fixed halving schedule and is not subject to a governance emission ceiling above it - the genesis reward is the bound (emission ≤ 96).
• R9.2 - Halving. Emission MUST halve geometrically on block-indexed era boundaries era(b) = ⌊b / H⌋ (H = halving_interval_blocks = 63,072,000), floored: 96 → 48 → 24 → 12 → 6 → 3 after max_halvings = 5, then floor_reward = 3 FLOP/block forever. A distribution period (last, now] straddling an era boundary MUST price each produced block b ∈ (last, now] at era(b)'s rate. Because genesis block 0 is unrewarded (R9.7), era 0 comprises H − 1 = 63,071,999 rewarded blocks (1..=63,071,999) and each era e ≥ 1 comprises H = 63,072,000 rewarded blocks (e·H..=(e+1)·H − 1). Block rewards are liquid on issue (R9.13); airdrop grants unlock under §8.2 R8.7. Cumulative emission through the halving phase (end of era 5, block 378,431,999, ~year 12) is R₀·H·63/32 − R₀ = 11,920,607,904 FLOP (2·R₀·H·63/64 = 11,920,608,000 in the H-blocks-per-era closed form before subtracting unrewarded block 0); it reaches 2·R₀·H − R₀ = 12,109,823,904 FLOP (2·R₀·H = 12,109,824,000 before subtracting block 0) at the end of era 6 (block 441,503,999, ~year 14) - not a hard cap; the perpetual floor then adds floor_annual_emission = 94,608,000 FLOP/yr forever.
• R9.3 - Subsidy. The Labs/Foundation subsidy MUST be a separate mint (flop-subsidy), on top of - never part of - the block reward. Each of FLOP Labs and the FLOP Foundation MUST receive subsidy_per_block_per_recipient = 8 FLOP/block in halving era 0, and the rate MUST halve on the same 63,072,000-block boundaries as the block reward (era(b) = ⌊b / H⌋: 8 → 4 → 2 → 1 → 0.5 per recipient) and be exactly 0 from era 5 - the subsidy TERMINATES on the same boundary where the reward FLOORS (b = 315,360,000). Era 4's 0.5 FLOP is fractional in FLOP but exact in base units (5 × 10¹⁷), and the implementation MUST NOT truncate it. The exclusive sunset block is subsidy_duration_blocks = 315,360,000 (5·H, ~10 years); with genesis block 0 unrewarded (R9.7), the subsidy mints on 315,359,999 produced blocks (63,071,999 in era 0 and 63,072,000 in each of eras 1-4), so total minted = 63,072,000 × (16 + 8 + 4 + 2 + 1) − 16 = 1,955,231,984 FLOP (1,955,232,000 in the H-blocks-per-era closed form before subtracting unrewarded block 0).
• R9.4 - Genesis. Genesis is work-first (no VC pre-mint, no auction, no team allocation). genesis_supply = 4,400,000,000 FLOP MUST be allocated to exactly four genesis buckets and nothing else: the three airdrops - genesis_miner_airdrop, genesis_validator_airdrop, genesis_agent_airdrop (3,600,000,000 FLOP together, 1,200,000,000 each) - plus the ecosystem reserve genesis_reserve = 800,000,000 FLOP, which is a genesis allocation but not an airdrop (earmarked for off-chain explorer referral leaderboard payouts, periodic referral lotteries, builder programmes, and security-disclosure rewards, superseding on-chain referral commissions). The four MUST sum to genesis_supply exactly. The validator cohort is definitionally the aggregate bond - validator_min_stake × validator_active_set_cap - so, when genesis parameters are chosen, a change to the bond floor moves this cohort and therefore genesis_supply (D-0440).
• R9.5 - Committee premium. The block-reward validator 10% pool (validator_share_ppt = 100 ppt) MUST NOT be increased by an emission surcharge or a second mint. (The separate 15% inference-fee validator share is an extrinsic settlement fee leg, not an emission or dilution of block rewards; see Appendix D). It is split inside the pool with weight stake_i × (1.1 if i ∈ current finality committee else 1.0), integer dust assigned deterministically so payouts sum exactly to the pool. This holds unchanged under the four-way split: the agent and staker legs are carved out of the miner residual (miner_share_ppt 900 → 750 ppt), never added on top, so validator_share_ppt stays at 100 ppt.
• R9.6 - Transaction-fee split. Protocol-wide fee routing MUST operate with zero burn: tx_fee_burn_percent_live = 0% burn (BurnFees), with the block author receiving tx_fee_author_share_percent_live = 100% of the transaction inclusion fee (base + encoded-length + adjusted-weight fee) and 100% of tips. Inference settlement fees likewise carry 0% burn (split 85% miner / 15% validator per §12.1 R12.1a). Full taxonomy: Appendix D.
• R9.12 - Agent & staker legs. The agent_share_ppt = 100 ppt and staker_share_ppt = 50 ppt legs MUST be minted every distribution period to two protocol-derived sovereign pool accounts (PalletId, §9.3 R9.10 shape), one per leg. The staker_share_ppt = 50 ppt (5%) leg funds the duration-locked community staking pool across seven lock duration tiers with no slashing risk and no validator or miner intermediary. Onward distribution from either pool MUST NOT occur until its distribution policy is ratified (E.40); the pools accrue and the mint is evented. The two legs MUST be carved from the miner share, so the four legs sum to 1000 ppt with the validator pool unchanged (§9.1 R9.5).
• R9.13 - Reward liquidity. The miner and validator legs of every block reward, and the Labs/Foundation subsidy, MUST be liquid on issue: the protocol MUST NOT auto-compound them into stake, force-stake, vest, or otherwise lock them. The agent leg accrues in its sovereign pool under R9.12, and that accrual is not a lock; once its distribution policy is ratified (E.40), every agent-leg payout MUST be liquid on payment. Bonding a liquid balance as stake remains the holder's choice. The staker leg's liquidity remains E.40.

9.2 Survival governor (default OFF, governance-armed)

A state-dependent supply-side governor MAY be armed by governance to damp the exodus spiral near collapse thresholds only (governor_default_enabled = false): a utilization-indexed emission damping (lift miner reward when utilization is low; indexed on utilization, never price - anti-Terra; governor_emission_damping_util_floor / governor_emission_damping_max_boost) and a dynamic burn schedule (10→15→25% by era: governor_dynamic_burn_tier1 … tier3). The Day-730 participant-revenue cliff (miners 72 → 36, validators 9.6 → 4.8 FLOP/block) is the first stress case; total per-block issuance falls by exactly half there (112 → 56), because the subsidy halves alongside the reward rather than sunsetting. The deepest total-issuance step is now Day 3650 (era 5), where the reward reaches its perpetual floor and the subsidy terminates outright: 7 → 3 FLOP/block, a 4/7 ≈ 57.1% drop.

Demand-coupled rewards (invariant). PoUI MUST pay only for work with a payer-authorized demand record, the applicable verification evidence, and settlement, or for the explicitly bounded synthetic-task bootstrap floor. A payer-authorized record proves protocol demand; it does not prove an economically independent customer. A miner-controlled payer can buy genuine inference and recycle much of the payment while pursuing work rewards. Whether this is profitable depends on unrecoverable compute, fees, capital, audit costs, reward and rebate schedules, and coalition ownership; the external-demand and wash-demand model is E.49.

9.3 Genesis configuration

The consensus-critical genesis essentials (the operational deployment runbook - GENESIS_AND_DESUDO_RUNBOOK - stays separate).

• R9.7 - Supply at genesis. Total genesis supply MUST be genesis_supply = 4,400,000,000 FLOP (18 decimals), held at genesis only by the three airdrop cohorts and the ecosystem reserve of §9.1 R9.4 - no VC pre-mint, no auction, no team allocation. No block reward has been emitted at genesis; era 0 emission begins with block production.
• R9.8 - Chain-spec constants. Fixed at genesis and consensus-visible: 18 decimals (base unit 10⁻¹⁸ FLOP); the user-facing ticker via TOKEN_SYMBOL (a mainnet branding step, §14.2); the SS58 prefix SS58Prefix = 42, the generic Substrate prefix, identical on every FLOP network (§6.5); 1 s block time; existential deposit 0.01 FLOP.
• R9.9 - Initial authorities. The genesis chain spec MUST seed the initial validator set and its session keys (BABE + AlephBFT), bootstrapping the §2 finality committee. Post-genesis, ActiveValidators admits validators only through §15 rotation promotion from ValidatorQueue and through un_jail / rejoin restoration of jailed or extended-downtime-kicked validators within validator_active_set_cap (§15.5, §15.7).
• R9.10 - Protocol sovereign accounts. The FLOP Foundation and FLOP Labs accounts are protocol-derived (PalletId sovereign accounts; mainnet SHOULD bind each to a multisig). They are the genesis-defined recipients/sinks for the Labs/Foundation subsidy (§9.1 R9.3), 100% of slash proceeds across all fault paths (§11.3, zero burn), and the failed-session penalty φ (§12.1d) - never miner revenue.
• R9.11 - Bootstrap origin & de-sudo (one-way). At genesis, Root is held by pallet_sudo (§14.1, index 50) - a public dev key on devnet, a multisig on mainnet. Governance is not the sole Root authority until the de-sudo handoff neuters and removes pallet_sudo and routes RawOrigin::Root to the protocol_upgrade track (§14.1). The production runtime MUST NOT expose a Sudo key or a non-governance Root path after handoff. An arbitrary governance-approved set_code can replace these guards; the claim is therefore scoped to approved runtime code (§14.1, E.50).

Rationale & sources (non-normative)

Provenance: D-0513 (SS58 prefix 42 on every network, R9.8), D-0440 (validator bond 305,505 → 1,200,000, carrying the validator cohort 305,505,000 → 1,200,000,000 and the pool 3,500,000,000 → 4,400,000,000; supersedes D-0438's pool and D-0435's bond, leaves emission untouched), D-0438 (genesis pool 2,483,460,000 → 3,500,000,000 with the four cohorts re-cut; supersedes the D-0421/D-0435 pool sizes, leaves emission untouched), D-0436 (five halvings, 3 FLOP floor, 5-era subsidy - supersedes D-0421's sixth-halving clause and amends D-0435's subsidy schedule), D-0435 (four-way split, halving subsidy), D-0421 (work-first genesis), D-0408 (validator split), D-0410 (survival governor), D-0529 (zero burn protocol-wide: 0% tx-fee burn, 0% inference-fee burn, 100% of slashes to FLOPFoundationAccount, superseding the interim 10% burn and 80/10/10 target), D-0530 (operator self-stake only; 5% duration-locked community staking pool across 7 tiers), D-0531 (off-chain explorer referral leaderboard and periodic referral lotteries funded from genesis_reserve, superseding the workbook's 6-10% on-chain referral commissions). Bootstrap-in-equilibrium (token seigniorage subsidizing useful inference below compute cost - the Duplexia regime): Pass et al., Economics of PoUW, arXiv:2606.06700, with FLOP's duplex overhead δ ≈ low single-digit % (below Pearl's cuPOW ~10% reference, arXiv:2606.04819) machine-checked as Duplexia.subsidy_below_cost. Grounding: halving-exodus-boundary-conditions.md, fee-design.md, miner-validator-economics.md, agent-token-economics.md, f2-exodus-threat-model.md, pouw-landscape-2026.md, gonka-cocoon-deep-dive.md, demand-bound-useful-work-certificates.md. Review demand/value-risk evidence: prepublication-evidence.md. The subsidy and participant-economics claims remain conditional on external-demand, distribution, collateral-value, and concurrent-exposure inputs in E.8, E.35, E.38-E.40, and E.49. Provenance clarification: D-0501. Full model: Tokenomics Specification. Formal: tokenomics-supply.qnt, FlopSpecs.lean, FlopSpecs/HalvingBoundary.lean. Status: Appendix H.

---

10. HTLC Atomic Swap

stateDiagram-v2
  [*] --> CREATED: lock funds behind H = SHA256(s)
  CREATED --> SETTLED: redeem or relay valid preimage
  CREATED --> REFUNDED: refund request after finalized timeout
  SETTLED --> [*]
  REFUNDED --> [*]

has-station implements create/redeem/refund_htlc and create_cross_chain_htlc.

10.1 Requirements

• R10.1 - Local atomicity & conservation. Each FLOP-leg hashlock H = SHA256(s) MUST permit at most one of redeem/refund, conserve locked funds, and forbid double-claim. The shipped htlc_burn_share_ppt is zero; timeout resolution preserves the full locked principal under this setting. End-to-end cross-chain completion is conditional on the named pair's finality, inclusion, preimage, timeout, identity, fee, and relayer assumptions in §10.2-§10.3; it is not an unconditional atomicity guarantee.
• R10.2 - Timelock symmetry. After converting the foreign duration to one-second FLOP blocks, T_FLOP MUST satisfy T_FLOP ≥ T_other + max(ceil(T_other × p / 100), max_finality_stall + current_finality_lag), where p is htlc_timelock_symmetry_safety_margin_percent, max_finality_stall is max_finality_stall, and current_finality_lag is the number of blocks by which the block evaluating the admission leads the finalized prefix (FinalizedPrefix, R2.2), i.e. block_number − finalized_number read in that block. create_cross_chain_htlc and cross-chain create_htlc_commit MUST apply the finality-open gate before evaluating this relation: if current_finality_lag is at or above finality_freeze_threshold, the open is rejected. Thus, this relation is evaluated only for lag below that threshold. The relation is evaluated at admission and equality is admissible: a T_FLOP exactly equal to the right-hand side is accepted. This margin is a necessary admission condition, not by itself a timely-inclusion guarantee.
• R10.3 - Refund reorg-safety. A refund MUST be gated on the AlephBFT finalized head, not the tip (a tip-gated refund is reorg-unsafe).
• R10.4 - Relayer trust. relay_preimage MUST be permissioned (root-managed allowlist, register_relayer / RegisteredRelayers): a relayer only releases an already-locked HTLC to itself on a valid preimage. Deployments additionally assume that this allowlisted account is the intended counterparty because an order recipient is not bound in the runtime call.
• R10.5 - Multi-block settlement. A long generation MUST lock an estimated max G_n and settle the actual amount at redemption from the attested token count; timeout auto-refunds.

The dormant nonzero timeout-burn implementation is a proposal (D-0523), pending ratification and a separate runtime upgrade. It is not an activated economic rule or a fee-floor guarantee.

10.2 Chain-pair qualification

The FLOP-leg state machine and each counter-chain component are distinct. Pair-level completion depends on unresolved choices for direction, chain/asset/participant binding, per-leg finality and observation, timeout orientation and margins, recovery, and transaction inclusion. E.48 tracks those choices and the evidence needed to qualify a named pair; Appendix H records implementation status.

The initial-publication claim for FLOP/native BTC, FLOP/native NEAR and FLOP/NEP-141-on-NEAR is target-only in the counter-chain-reveal → FLOP-relay direction. A timeout enables refund; it does not by itself extinguish a hashlock claim. Completion and refund targets therefore depend on both chains' inclusion and terminal-transition ordering, including counter refund before a late claim. No deployed chain-pair completion guarantee is asserted.

10.3 Incentive robustness

Plain HTLC is cheap to attack (MAD-HTLC): a rational counterparty can bribe fee-maximizing block authors to withhold an honest redeem/refund until the timelock flips. A finalized-prefix refund removes one local reorganization hazard; it does not guarantee that a redeem is included before its deadline. The local contract proves that at most one redeem/refund transition succeeds under its state machine. Cross-chain atomicity additionally assumes per-leg finality, timely inclusion, correct timeout orientation, preimage availability, and relayer recovery. The fee-floor deterrence theorem is conditional on an honest fee at least the coalition's remaining extractable value. The fee and inclusion design needed to discharge that premise remains open in E.48.

Rationale & sources (non-normative)

Prior art: MAD-HTLC (arXiv:2006.12031), He-HTLC (ePrint 2022/546) which burns a share of the colluding path. Provenance: HTLC formal→pallet mapping in formal-to-implementation-bridge.md; trust claim htlc.counter_chain_bribery_residual in trust-manifest.toml; bridge options docs/bridge/settlement.md. Review assumptions: prepublication-evidence.md. Provenance clarification: D-0501. Internal qualification evidence: chain-pair HTLC evidence. Formal: FlopSpecs/Temporal.lean (htlc_atomic, refund_within_tlock), FlopSpecs/HtlcIncentives.lean (collusion_deterred, no_burn_floor), FlopSpecs/HtlcRefundFinality.lean (refund_final_safe), htlc-atomic-swap.qnt. Status: Appendix H.

---

11. Security Invariants

Quint/TLA+ models under ../formal-specs/ describe versions of the invariants below. The invariants are normative. A model-checking result applies to the stated model, assumptions, explored bounds, and tool run; a model file alone is not a proof of every implementation execution. The attribution index and Appendix H separate those artifacts from runtime enforcement and open conformance obligations.

11.1 Enforced invariants

11.2 Session G_n settlement gate

• R11.2. Channel settle / force_settle MUST call GnSink::validate_session_gn before payout or credit: a non-zero aggregate G_n MUST fit the credit domain, the miner efficiency ceiling, the finalized calibration cap, the §6.1 capacity bond, and the reject-only throughput tripwire (§4.1).
• R11.2a. This is a plausibility bound, not execution validation. settle MUST verify each submitted VerifiedTurn signature and Merkle path against one final_root, reject duplicate or out-of-range turn indices, checked-sum the submitted g_n values, and require that sum to equal aggregate_gn (verified_work_from_turns; §12.1). This authenticates the submitted leaf values and their arithmetic. It does not prove that the claimed execution occurred or that the submitted turns exhaust an independently committed transcript (E.43/E.44).
• R11.2b. Current-profile channel payout MUST NOT issue public work credit, increase reward accumulators or performance-vesting work, refresh committee recency, or update calibration from a receipt. This applies to cooperative, certificate, unilateral, forward, and unrecoverable-DA payout. Challenge expiry alone MUST NOT make a receipt eligible for public work credit. (Private, payment-denominated Miner unlock credit and Agent spend credit on Era-0 airdrop grants under §8.2 R8.7 are not public work credit, block-reward accumulation, or work-vesting (R_p²), and accrue after finality plus channel_dispute_window_blocks as governed by R8.7.) Future independently audited public work credit and recovery of historical credit require the separate evidence and protocol disposition in E.44.

11.3 Validator slashing table

pallet_validators is the single authority for validator penalties.

Collusion/forgery/TEE stay flat 100% (evidence-backed fraud). Equivocation is the only correlated, recoverable class (a lone double-sign is most often an honest failover bug). All slashed collateral routes 100% to FLOPFoundationAccount with zero burn (§9.3 R9.10). Operator stake is self-stake only (third-party delegated staking is prohibited); where legacy or testnet sponsored backing (E.32) is present, the loss order charges operator self-stake first and sponsors thereafter at the fault rate (legacy delegator waterfall entries are deprecated).

Rationale & sources (non-normative)

Provenance: R11.2b payment-only scope, D-0409 (slashing-table reconciliation), D-0420 (correlated equivocation), D-0419 (unbonding slash-lock), D-0529 (zero burn; 100% of slashes to FLOPFoundationAccount), D-0530 (operator self-stake only; delegation waterfall deprecated). The P0 agent-economics sweep (INV-02, fail_task, session nonce, payout atomicity) closed the four flagged-not-enforced invariants. Grounding: formal-specs-agent-economics.md, session-work-verification-gap.md, fee-design.md, economic-security-proofs.md, network-valuation.md (value-coupled floor V_booked = a·n_eff + b·n_eff² + c·v̄·D₂, C5/D-0413). Formal: FlopSpecs/Security.lean (StakingSlashing, CoCVoC), FlopSpecs/Sessions.lean, channel/session-gn-integrity.qnt. Status: Appendix H.

---

12. Agents as Market Actors - Sessions & Settlement

FLOP's compute consumers are autonomous, strategic AI agents. This section specifies the settlement path they use (attested streaming sessions), the per-identity caps that bound them, and the market-actor threat class they create.

12.1 Sessions - attested streaming & aggregate settlement

Inference settles through pallet_compute_channel - the sole inference-dispatch path (the former per-task 4-extrinsic RPC rail is removed). A cooperative happy path has two primary lifecycle inclusions, open_channel and settle; unilateral close, evidence publication, escalation, and disputes add calls. Settlement bytes and verification cost are not constant: settle carries and verifies submitted turns, signatures, and Merkle paths; pairwise duplicate scanning is quadratic in submitted turn count. The inference stream remains off-chain, but throughput depends on encoded bytes, runtime weight, evidence calls, committee load, and GPU capacity (E.46).

• R12.1a - Reserved capacity and fee split. Escrow at open_channel is the payment for reserved capacity; under-use MUST NOT be refunded. The only refund paths are a non-delivery timeout, an upheld fraud dispute, or a failed/early-terminated session (R12.1d). At settlement (settle, certificate_settle, or force_settle → finalize), the settled payable amount MUST be split: inference_fee_miner_share_ppt = 85% to the miner, and inference_fee_validator_share_ppt = 15% to the validator pool (D-0525). The 1% audit pool earmark (audit_fee_split_ppm = 10,000 ppm) MUST be deducted from the 15% validator share to fund verification audits; the remainder of the validator leg is distributed intra-pool by the R9.5 weighting, liquid on issue (R9.13, D-0518).
• R12.1b - Transcript. The enclave (or, on the SOFT path, the miner session key) MUST sign each turn's 32 B transcript-leaf hash into a running Merkle accumulator. Appendix F.3 is the sole leaf definition and accepted-version rule; V3 is the current TOPLOC-binding format for a channel carrying a ChannelDecodePolicies marker. Uniqueness is channel_id ‖ turn_index; replay protection is the monotonic counter. Before accepting output, the agent MUST verify the signed leaf and cumulative root and counter-sign the turn with the Appendix F.3 per-turn agent ack over the leaf hash and timing inputs. Settlement carries the separate agent receipt v1, which binds channel_id, final_root, aggregate_gn, and payable exactly as defined in Appendix F.3. settle posts the final root + aggregate G_n. These signatures prove agreement on a receipt and sum; they do not prove that the output resulted from the claimed execution. The current cooperative path pays private escrow immediately and issues no public work credit (R11.2b). Future audited reward eligibility and recovery of historical credit after late fraud remain open in E.44.
• R12.1c - Tier-specific model binding. A HARD-tier open_channel and settle MUST verify the proof's measured dm-verity root against the registry (ModelRegistryQuery::verify_measured_root); a wrong root at settle MUST reject. The SOFT profile has no TEE-measured root; its model/decode binding, evidence predicate, value cap, and dispute path are E.33.
• R12.1d - Failed/early close split. On the unilateral force_settle → finalize path the earned tariff P = BasePerTurn·n + rate_G·G_claimed (flat per-turn payment over n turns plus claimed reference-work converted into payment units) forms the payable session settlement, which is split 85% to the miner and 15% to validators (with the 1% audit pool funded from the validator leg) under R12.1a. P is denominated in the escrow's base unit (10⁻¹⁸ FLOP); channel_base_per_turn and rate_G are each one base unit. G_n is the whole-reference-GFLOP integer from R4.4; the rate is a tariff price, not an assertion that one G_n equals one FLOP base unit. force_settle MUST reject with TariffExceedsEscrow when P > E; it MUST NOT clamp P or create negative payout legs (pallets/pallets/compute-channel/src/lib.rs::{turn_tariff_pay,verified_work_from_turns}). Otherwise, the agent is refunded (1−φ)·(E−P), and the penalty φ·(E−P) (refund_penalty_phi_percent = 20%) MUST be transferred in full to FLOPFoundationAccount (§9.3 R9.10) with zero burn - never the miner. A miner-fault non-delivery uses φ = 0 (full refund). Conservation: P + (1−φ)(E−P) + φ(E−P) = E. Caller restriction and tariff magnitude on this path are E.24.
• R12.1e - Over-use. Handled by abort or in-place top_up_escrow (Lightning splice-in); the aggregate-G_n accumulator already grows unbounded, only the escrow cap is raised.
• R12.1f - Disputes (fraud only). Optimistic settlement + bisection over the transcript root: a challenge resolves at a single contested turn (signature + Merkle-membership check); a non-response within channel_dispute_response_window_blocks MUST default to a fraud verdict → slash via the miner-slashing forgery path + agent refund. Disputes cover protocol fraud only (wrong measured root, inflated G_n vs transcript, forged signatures, non-delivery) - never output quality. The challenge window (channel_dispute_window_blocks = 7 d) plus every bisection leg, the terminal response, and one degraded extension MUST fit strictly inside DA retention W (14 d), as specified by R1.2a. A force-settled transcript reference MUST be naturally available through that worst-case end before it is pinned; a pin prevents pruning but does not extend expiry. Standing is the session agent (its own channel) + any active validator (any channel); arbitrary public challengers MUST be rejected before bond lock.
• R12.1g - Finality-stall recovery. Deadlines MUST read hp_consensus::FinalizedPrefix and economic deadlines MUST freeze while finality stalls. Funds MUST NOT release from an unfinalized best head. Recovery is restored AlephBFT finality or an explicitly ratified checkpoint procedure under §13.0a; unresolved channels remain frozen until that recovery establishes a finalized prefix.
• R12.1h - Session length & re-attestation. Trust shifts to the session enclave key attested once at open_channel. A channel MUST bound blast radius by a max duration D_max / max turns n_max (channel_max_settlement_turns caps a bundle at 1,024), and SHOULD re-attest every k turns with k ≤ min(Bond / v_turn, T_tcb / t_turn).

Capacity disposition. No session-control transactions-per-block, finalized-lifecycles-per-second, or inclusion/finality-latency target is specified. D-0502 proposes to withdraw the former 96/128 admission and 48/64 lifecycle figures because they were derived from call count rather than serialized size, charged weight, state execution, competing traffic, serving load, and network finality. Admission remains subject to the runtime's byte, two-dimensional weight, state, and validity gates. A future profile MUST reserve measured settlement/dispute headroom under congestion and satisfy E.46 before making a capacity claim.

12.2 Per-identity capacity reservation

• R12.2. The session per-identity in-flight reservation cap MUST be enforced at open/force_open: base max_active_reservations_base plus one slot per escrow_per_reservation_slot escrowed; freed on settle/expire/timeout/fraud. Per-block work is bounded by the consensus max_gn_weight (≤ 1 PFLOP / payload). High-value/blast-radius audit forcing uses high_value_gn_threshold and audit_quantum_gn.

12.3 Market-actor threat class

Autonomy creates a threat surface none of the target/vector models (§3.1, §2.4, §6.2) cover: tacit algorithmic collusion (RL bidding agents learn supra-competitive prices with no communication), compute hoarding/cornering, wash/Sybil bidding, attestation-gamed pricing, MEV-on-compute, and reservation griefing. The FLOP asymmetry: TEE-bonded miners are Sybil-hard supply while lightweight agents are Sybil-soft demand, so §2.4's Sybil cost MUST extend to the demand side (registered agent_identity_min_stake + reservation = a capital floor linear in identity count). The current registry merely reserves/locks that minimum; it neither burns nor slashes it, so the floor is capital exposure rather than an irrecoverable identity cost.

• R12.3. A collusion response MUST perturb the mechanism (re-randomize the auction, coarsen the grid, inject synthetic demand) rather than punish individuals (no provable intent). Monitoring gauges (bid-dispersion collapse, held/circulating ratio, utilization→scarcity) drive both the detector and the §9.2 governor.

12.4 Cryptographic adversary model

Every proof in this spec assumes a classical PPT adversary (Crypto.lean is a symbolic Dolev-Yao model). It is not quantum-resistant: a scalable quantum adversary breaks sr25519/ed25519/secp256k1 (Shor) and halves SHA-256 preimage security (Grover). Post-quantum migration is out of scope until a PQ primitive is on the roadmap; the boundary is explicit (crypto.quantum_adversary, trusted/todo).

Rationale & sources (non-normative)

Provenance: D-0403 (capacity-reservation sessions), D-0422 (refundable failed sessions), D-0424 (dispute standing), D-0427 (withdrawn throughput target), D-0430 (degraded-state matrix), D-0501 (verification, finality, unit, and claim-scope clarifications), D-0502 (capacity disposition), D-0511 (canonical session-transcript and receipt definitions), D-0529 (zero burn protocol-wide; the R12.1d penalty φ·(E−P) routes to FLOPFoundationAccount). Frame threats on OWASP Agentic Top-10 (2026) + ATFAA/STRIDE + MITRE ATLAS. Controlled repeated-auction evidence finds that LLM bidders produce supra-competitive outcomes in small markets and return toward competition as bidder count grows (Tolety 2025); this empirically grounds R12.3 but is not an assumption of the formal deterrence theorem. Grounding: agent-market-threat-and-compute-economics.md, agent-swarm-collusion-design.md (bid-dispersion + price-level detector, mechanism perturbation, reproducible ABM), r2-payment-channel-sessions.md, session-matching-orderbook-vs-agent-select.md, session-migration-semantics.md, f1-f2-store-of-compute-and-network-survival.md, compute-spot-market-formation.md, frcr-methodology-v0.md, triz-ifr-agent-market-ideas.md (C-TRIZ pass: system IFR, open-contradictions ledger, verification/discovery/fairness clusters), agent-demand-discovery-mechanisms.md (agent demand loop: typed need, bounded spot proof, receipt propagation, graduated CRU commitment), proposal-capacity-reservation-units.md (CRU - bonded forward compute, ratified as D-0434; implementation as forward-dated channels), term-curve-methodology-v0.md (the observational CRU forward curve: terminal bonded settlements only, 1d/7d/30d buckets, quantity-weighted median under publication floors - never blended with spot FRCR), dispute-window-rightsizing.md (the 7 d → ~1 d rightsize analysis, deferred). Agent-security cluster: security-across-domains.md, agent-security.md, agent-specific-security.md. Formal: DemandSideSybil.lean, ChannelPayoutLiveness.lean, FlopSpecs/Sessions.lean, formal-specs/channel/channel-settlement.qnt. ChannelPayoutLiveness::escape_safe models the prior best-head escape and is not a witness for R12.1g after D-0501; the finality-safe replacement needs a new witness. DemandSideSybil.lean keeps capital and incentives separate: postedCapital is exposure, postedCapital_ge_card_mul_floor proves only the identity-count-linear capital bound, and individual_deterred_iff requires explicit irrecoverable cost plus lost continuation value for deterrence; yellowpaper#58 applies that split to the current floor. Venue-specific observations reported in yellowpaper#30 and yellowpaper#34 are unverified design inputs, not rules: arrival dispersion (inter-arrival coefficient of variation) and timing/structural signals missed by wash pair-counting are candidate gauges. The shipped turn_ack_message (sdk/typescript/src/compute-channel/transcript.ts and sdk/rust-compute-channel/src/transcript.rs) has no domain tag or version byte; like the transcript leaf, it relies on its channel_id ‖ turn_index binding, and changing either preimage is out of scope here. Review evidence: prepublication-evidence.md. Status: Appendix H.

---

13. Failure Semantics - Actor × Failure Matrix

Machine-legible failure semantics per actor: failure → detection signal → protocol response → what the agent observes → recovery. Adversary model: agents are fast and may be malicious; miners may be malicious; validators may crash or collude. Rows marked [GAP] are unhandled/unspecified (indexed in Appendix E); rows marked [OOS] are out of protocol scope by design. Per-row implementation status lives in Appendix H. Economic mass-failure (exodus chains C1-C7) is in f2-exodus-threat-model.md.

13.0 Degraded-state settlement policy (normative)

R13.0. A liveness repair MAY extend or pause a window, but it MUST NOT convert missing or stale evidence into a miner payout. Each degraded-state row below is a normative settlement policy:

13.1 Miner (malicious or crashed)

13.2 Validator (consensus + DA + leader duties)

13.3 Validator attestation quorum (BFT fraction)

Active validators run DCAP/dstack off-chain and submit ValidatorAttestation bundles; the chain checks distinct active-validator signatures against ceil(active_count × validator_attestation_threshold).max(1) (default 2/3).

13.4 Finality & block production

13.5 Agent (fast, malicious, or crashed)

13.6 Publisher

13.7 Off-chain infrastructure

Rationale & sources (non-normative)

Provenance: D-0430 (degraded-state matrix), D-0409/D-0420 (slashing), D-0416 (rotation), D-0424 (dispute standing), D-0426 (checkpoints). Grounding: da-loss-beyond-k-dispute-default.md, validator-attestation-outage-degraded-mode.md, session-migration-semantics.md, session-discovery-reputation.md, decentralized-inference-project-scan-2026-07.md (July-2026 landscape scan; discovery/offer, privacy-label and multi-miner gaps). Finality-stall stance: docs/plans/FINALITY_STALL_STANCE.md. Formal: SettlementOrdering.lean, account-recovery.qnt, formal-specs/channel/settlement-degraded-window.qnt. Status: Appendix H.

---

14. Governance & Protocol Upgrades

Governance is OpenGov: pallet_referenda, pallet_conviction_voting, custom Origins, pallet_scheduler + pallet_preimage (enactment/timelock/large-call storage), pallet_treasury, pallet_multisig, pallet_proxy (with a Governance filter). Break-glass: pallet_emergency_override (root-only, emergency_override_timelock = 72 h, emergency_override_cooldown = 7 d) and pallet_emergency_pause (granular per-pallet/global circuit breaker with auto-expiry).

14.1 Requirements

• R14.1 - Protocol-upgrade track. The production protocol_upgrade (Root) track MUST route RawOrigin::Root so a referendum can dispatch set_code / any EnsureRoot call. Approval MUST be flat protocol_upgrade_approval = 67% (BFT 2/3); support MUST meet the turnout floor protocol_upgrade_support_floor (linear 50% → 15% of ActiveIssuance); enactment MUST be timelocked protocol_upgrade_enactment_timelock = 14 d via the Scheduler. Decision period, prepare/confirm, and decision deposit are E.9.
• R14.2 - Bootstrap submit gate. Through the first halving (block 63,072,000), protocol-FIP submission MUST sit solely with the FLOP Foundation (EnsureFoundationProtocolSubmit) - submit control, not vote control; approval/support/timelock still apply. The gate sunsets at that boundary.
• R14.3 - De-sudo. Governance is not "live" until every EnsureRoot site is reachable through a governance origin and pallet_sudo is neutered (remove_key) and absent from the production runtime. This is a property of the approved runtime code, not an invariant against a future Root set_code replacement.
• R14.4 - Enactment boundary. A forkless change (on-chain WASM set_code) MUST follow the storage-compat discipline (spec_version bump + try-runtime). A coordinated change (consensus engine, host functions, P2P, finality gadget) cannot be enacted by a runtime call: governance authorizes, a node-binary release activates at an upgrade-deadline block height.
• R14.5 - Current-runtime safety envelope. Parameter-update calls exposed by the approved runtime MUST NOT leave the safety envelope (≥67% approval, ≥15% quorum, ≥14 d timelock, ≥ validator_min_stake (1,200,000 FLOP) stake floor, no self-disable; the formal model in governance.qnt and Governance.lean expresses this as 1200 in units of 1,000 FLOP); each such enactment MUST be rate-limited (governance_param_max_step_pct). These guards and their formal model do not constrain arbitrary replacement code dispatched through Root set_code. Safety across runtime replacement depends on review, voter approval, and social governance; the approved-code assumption is E.50.
• R14.6 - Circuit breaker. A hardcoded protected set (consensus/inherents, Scheduler/Preimage, governance voting, the breaker itself, Sudo) MUST NOT be pausable; pauses MUST auto-expire. Post-de-sudo, the pause origin MUST stay fast (an ops multisig, not the timelocked track), with a distinct resume origin.

14.2 FIP binding

A FIP is a numbered off-chain design doc. On-chain, a protocol_upgrade referendum binds to it via referenda.set_metadata (a Preimage hash of the FIP text); no structured on-chain FIP metadata is required.

Rationale & sources (non-normative)

Provenance: D-015 (67% + break-glass), D-0415 (adopt OpenGov, supersede the custom FIP pallet SPEC-024), D-0425 (Foundation submit gate through first halving), D-0501 (current-runtime scope and approved-code assumption). Work breakdown: docs/plans/GOVERNANCE_ACTIVATION_PLAN.md. Formal: FlopSpecs/Governance.lean (GovernanceTransition), governance/governance.qnt. These witnesses quantify over the modeled permitted updates, not arbitrary replacement bytecode. Review evidence: prepublication-evidence.md. Open: E.9 (track magnitudes), E.50 (arbitrary-upgrade scope). Status: Appendix H.

---

15. Validators - Onboarding, Duties, Selection & Rotation

Validators are the staked security base: each authors blocks (BABE), finalizes them (AlephBFT), attests miners' proofs (§3.6), adjudicates checker verdicts (§3.5), and hosts the sovereign DA layer (§5.3). Pallet pallet_validators; committee gate hp_consensus::select_committee.

15.1 Roles

A validator secures consensus and, as part of that role, verifies and co-signs miners' attestations and checker verdicts via a BFT quorum. A validator function MUST NOT require executing inference, producing PoUI proofs, or owning a GPU or TEE: committee eligibility is verification liveness (§15.4), and re-execution is a checker duty (§3.5). Validators are not miners - a validator account MAY also register as a miner, but miner activity confers no validator eligibility.

15.2 Onboarding (normative)

Registration is self-signed and permissionless above the stake floor. register freezes exactly effective_minimum_stake() as self-stake and places the validator in ValidatorQueue, not directly in ActiveValidators - promotion happens only through rotation (§15.5).

Validator and miner stakes are self-stake only (§6.1); third-party delegation (legacy max_delegators_per_miner-class bounds and operator commission) is deprecated.

Where legacy or testnet sponsored backing (E.32) is enabled in the runtime, MinSelfStakeRatio (20%) bounds admitted backing to four times recorded self-stake. Since registration bonds exactly the effective minimum, surplus free balance does not increase this capacity, and the admission check does not preserve that ratio after a slash reduces self-stake (Appendix H).

Where sponsored_self_stake_enabled holds, active sponsored principal also counts toward the self-stake floor at queue promotion and rejoin (R6.1a), and a sponsor can register a validator that holds no balance. Native delegation still counts only operator-owned stake, so a fully sponsored validator accepts none.

15.3 Duties & resource intensity

The one heavy leg is DA storage/serving; no validator duty requires a GPU or TEE. A production validator SHOULD provision this reference profile: 8 physical cores at ≥3.4 GHz with SMT off, 32 GB ECC RAM, 4 TB enterprise NVMe (chain state plus DA custody under §5.3 retention), and a 1 Gbps symmetric unmetered link - the AlephBFT-class node reference plus storage.

Placement is a set-level concern, not a per-box one: because R2.3 counts Byzantine seats, the following fault-domain rules apply to production validators - one session key per machine, no shared-key failover, and no hosting ASN, metro, or operating group holding as many eligible validators as the Byzantine seats that break 3f < n (R2.3) for the realized committee size - 34 against a 100-seat committee - because seats never exceed identities. A tighter 10 % per-domain cap on identity count and on stake is proposed in D-0507 (pending).

15.4 Selection - the PoUI-gated committee

• R15.4a. The finality committee MUST be drawn by filtering ActiveValidators to those meeting effective_minimum_stake() and a recent accepted verification duty (R15.4c; stake and verification liveness - §2.3 sub-proofs 1 & 3), then randomly sampling finality_committee_size = 100 distinct members stake-weighted without replacement off a BABE-VRF seed (hp_consensus::sample_committee_weighted). pallet_aleph snapshots this committee each session (AlephEpochBlocks = 900 blocks; four sessions per production BABE epoch) and exposes authorities() to finality-aleph. The selection predicate uses the active set, stake, and recency at sampling; it does not assert that those inputs remain unchanged for the lifetime of the saved committee.
• R15.4b. The sampling seed MUST be BABE-VRF epoch randomness (fixed for the epoch, one epoch old), domain-separated per rotation. This delays and limits current-author influence; it does not by itself prove unbiasability. The seed-influence and repeated-draw analysis is E.42.
• R15.4c - Verification liveness. A validator's recency signal (LastVerifiedWork) MUST be refreshed only by an on-chain accepted verification duty: (a) being a signer of an accepted validator attestation bundle (R3.6b); (b) being a signer of an accepted TOPLOC mismatch or escalation-clear quorum (R3.5d, §12.1); (c) an accepted DA retrievability-audit response (R5.3b); (d) an accepted dispute opening by a validator (R12.1f); (e) a correct answer to a protocol-issued known-answer verification challenge - the §8.1 Ghost-Task pattern applied to verification: a VRF-selected fixture (an attestation bundle or a DA opening of a protocol-seeded liveness blob) whose expected verdict the chain already holds. Every signer of an accepted bundle or quorum MUST be credited. Prover credit (OnProofVerified) MUST NOT refresh it. The signal is recent when within WorkRecencyWindow = 86,400 blocks. Because (a)-(d) exist only when there is traffic, the protocol MUST issue every active validator at least one challenge (e) per window from block initialization rather than a privileged origin, with a response deadline that falls before the validator's current recency lapses, so an honest validator on a quiet or fresh chain cannot age out. Gate wiring is E.52.

If the eligible pool has fewer than 100 identities, selection MUST follow the ratified minimum-safe-size and bootstrap profile in E.42 before claiming conformance. An N=100 capture bound does not apply to a smaller realized committee, and paid work alone does not establish honest consensus behavior.

Composite performance score = 40% uptime + 30% block_rate + 20% accuracy + 10% latency (performance_score_weights); it is the rotation-floor input.

Pending ratification (v0.5 decision record): D-0508 redefines the four components as on-chain observable signals and retires the root-origin score oracle; D-0509 would align the 900-block committee session to the BABE epoch.

15.5 Rotation & set size

Rotation runs in on_initialize every validator_rotation_interval_blocks (~30 d) plus manual rotate.

• R15.5. Rotation MUST eject up to validators_to_eject = 50 from the bottom of the active set - bounded by validator_rotation_churn_percent = 10% (rounded up) and truncated to preserve at least validator_min_active_validators = 4 active seats (deregister, jail, and kick MUST likewise reject removal at or below the floor, and a proven-fault slash at the floor MUST confiscate stake (transferred to the Foundation per R9.10) and blacklist immediately while deferring seat removal until rotation can replace or shrink the set; see E.56) - and promote up to validators_to_promote = 50 from ValidatorQueue whose recorded self-stake ≥ effective_minimum_stake(). Rotation ejection removes the validator from ActiveValidators and thaws its self-stake freeze (the principal remains in the operator's account); re-entry goes through register into ValidatorQueue after ejection_cooldown_blocks (~7 d; configured in Config, enforcement in register pending), whereas un_jail (after MinJailBlocks = 3,600 for liveness jail) and rejoin (for extended-downtime kicks, topping up self-stake from free balance to effective_minimum_stake()) restore a jailed or kicked validator directly to ActiveValidators while a slot below validator_active_set_cap is free. Ranking MUST be by stake subject to a minimum-performance floor (verification liveness per R15.4c + uptime), so padding the liveness signal does not improve rank (only clearing the floor remains gameable).

• R15.5b. The active set MUST NOT exceed validator_active_set_cap = 1,000. register admits to ValidatorQueue, never directly to the active set; rotation promotion from ValidatorQueue and direct restoration via un_jail or rejoin MUST admit to ActiveValidators only while a slot is free, so the cap bounds ActiveValidators and never registration. Queued validators hold stake and may do useful work; they are not finality-eligible until promoted.

The current implementation attempts promotion in LIFO order within the requested budget and free slots; stake-ordered selection remains #1713. Underfunded candidates remain queued with their bond and backing intact. Promotion preserves stake and commission fields and resets performance and the joining epoch.

A queued candidate has no in-place self-stake top-up: transferring more funds does not update its recorded bond, and rejoin applies only to extended-downtime kicks. A raised effective floor, including an annual baseline increase, can therefore defer promotion until the floor falls back or the operator replaces the registration. Operators coordinating replacement first arrange any sponsor unbonding (native delegation is deprecated), then deregister and register at the new minimum; deregistration does not enforce this backing-removal procedure. Appendix H records the missing top-up path.

Set size. The active set is capped at 1,000; the finalizing committee is 100 (§15.4), sampled from the active set, so the two are separate bounds. Under D-0526 (resolving E.41 via Option (a)), every active validator (up to 1,000) is a BABE block authoring authority (MAX_ACTIVE_VALIDATORS = MaxAuthorities = 1,000), while AlephBFT finality evaluates strictly across the 100-member PoUI committee. Effective set size below the cap is governed by rotation throughput, the stake gate, and the runtime minimum-set and churn guards (validator_min_active_validators = 4, validator_rotation_churn_percent = 10%, validator_min_scored_samples = 3). How that runtime floor relates to the launch cohort, committee-safety premise, and skip-vs-truncate policy is E.56.

Composition of the first active set at mainnet genesis (post-testnet ranking by verification liveness, placement declaration, 10 % per-domain cap) and the move from fixed bottom-50 ejection to a performance floor are proposals pending ratification: D-0507, D-0508.

15.6 The validator across the session lifecycle

Inference streams off-chain, so ordinary validation does not re-execute every inference turn. Settlement still performs work proportional to submitted turns, signatures, and Merkle paths, and sampled audits add off-chain re-execution by the checker lane (R3.5d), never by the validator itself. Validator touchpoints:

Two distinct co-signings: (a) the validator BFT attestation quorum co-signs a proof for G_n credit on the direct rail; (b) the agent co-signs each turn's receipt and the settlement receipt. Only (a) is a validator duty; any re-execution behind either is the checker lane's (R3.5d). Miner and model selection is agent-driven (open_channel names the miner and pins model_hash); there is no on-chain scheduler.

15.7 Slashing & recovery

pallet_validators is the single penalty authority (§11.3 table); all slashed collateral is transferred 100% to FLOPFoundationAccount with zero burn (§9.3 R9.10). Fraud (Collusion / EvidenceForgery / TeeAttestationFailure) = 100% slash + eject + blacklist. Equivocation follows the correlated curve: a lone offence slashes 50%, returns the other 50% after 180 d, ejects the validator, and remains re-stakeable; ≥⅓ correlated equivocation slashes 100%, ejects, and blacklists. Liveness = 1% + jail; extended downtime = 5% + kick. validator_unbonding_blocks = 21 d with a slash-lock while a session/dispute/audit is open (D-0419); the cooldown exceeds the 14 d DA retention W, and its composition against the full dispute lifecycle is E.57.

Rationale & sources (non-normative)

Provenance: D-0408 (single validator-staking system), D-0413 (value-coupled floor), D-0416 (stake-ordered rotation), D-0437 (active-set cap), D-0409 (flat fraud classes), D-0419 (unbonding slash-lock), D-0420 (correlated equivocation), D-0501 (seat premise and cooperative-credit scope), D-0439 (verification liveness; CPU-class validator), D-0529 (zero-burn slash routing to FLOPFoundationAccount), D-0530 (operator self-stake only). Grounding: validator-miner-hardware-costs.md (§2.1 reference profile and comparables), validator-set-diversity.md (seat-counted placement bounds), miner-validator-economics.md, da-sovereign-validator-design.md, miner-capacity-stake-calibration.md, r2-payment-channel-sessions.md, session-work-verification-gap.md, prepublication-evidence.md, session-matching-orderbook-vs-agent-select.md. Ops guide: docs/onboarding/validator.md. Formal: FlopSpecs/Sessions.lean, formal-specs/channel/channel-settlement.qnt. Status: Appendix H.

---

Appendix A - Parameter Reference

The table below is generated from params/flop-protocol-params.yaml (the canonical machine-checked contract; every value is mirrored into runtime / SDK / sim code and gated by scripts/check_params.py). Regenerate with uv run --script scripts/gen_param_table.py; drift fails just verify-whitepaper. Each row is anchored #param-<name>, and prose links to the corresponding generated anchor. This table is the single authoritative list of the values themselves.

Enforced parameters (params/flop-protocol-params.yaml); every value below is mirrored into code and gated by scripts/check_params.py. Link a parameter anywhere in the spec with its generated #param-<name> anchor.

Genesis

Emission & Rewards

Developer Subsidy (separate from block reward)

Staking & Delegation

Compute-channel timing bounds

Sessions / capacity reservations (A1 anti-spam)

Finality-stall safe mode (compute-channel)

PoUI simulator-mode safety flag (#297 CRIT-02 / RT-C02)

D-0528 sponsor-owned registration bonds (devnet/testnet only)

PoUI submission rate limit

F2 supply-side governor (default OFF; governance-settable)

Governance

Consensus / finality committee

Validator security policy

Metering tripwire

Compute-channel settlement

Derived TOPLOC band (governance-set per model/precision; #685, #705)

Model registry (decode-policy sets)

Metering cert tokens-per-byte band (#871)

Metering cert circuit version + guest image-id registry (#929)

Transaction fees (live values)

Data availability

Agent wallet / session keys

Reference-only - canonical documented values, single-site or not yet wired for cross-language enforcement (enforce: false).

Cross-language names (canonical ⇄ Rust ⇄ Lean ⇄ Quint). The same protocol value carries a different identifier per language by convention; values agree where a language pins the real (non-demo) figure. Enforced rows are value-gated against the Rust site by check_params.py.

Derived quantities & narrative constants - structural values, formulas, and mechanism constants that are not part of the machine-checked numeric contract above (so they live here, not in the params file):

The open/unset values referenced above are specified as numbered fill-in stubs in Appendix E - Open Specification Items.

---

Appendix B - Sources

Decision records (MADR + changelog; each entry states its status): Decisions v0.4 - D-0401..D-0441 (consensus, sovereign DA, sessions, measured model_hash, measured G_n, validator-native attestation, governance, rotation-by-stake, composability, capacity-proportional miner stake, unbonding slash-lock, correlated equivocation, TOPLOC required, TEE-optional) + the v0.3 → v0.4 changelog. Decisions v0.5 - D-0501..D-0533 (public claim scope, wire formats, paid storage, validator policy, grant unlocks, reward routing, and parameter calibration).

Research corpus (each doc carries its full citation set): the whitepaper/research/ directory is the long-form grounding for every section; the per-section Rationale & sources trailers link the docs relevant to each. Cross-cluster index: triz-issue-decomposition.md (papers mapped to every open issue). Superseded/critical-review context: yellowpaper-critical-review.md (baseline audit). Reference specs: Protocol Spec · Tokenomics Spec · Formal specs.

Supporting literature (2025-26 scan; full set in the TRIZ doc):

• Consensus/finality - non-PoW longest-chain (in)security arXiv:2505.14891 · PoUW security arXiv:2405.19027 · deterministic BFT in a block DAG arXiv:2102.09594 · Shoal++ arXiv:2405.20488 · Lemonshark arXiv:2604.03974 · Ebb-and-Flow arXiv:2009.04987 · Aleph arXiv:1908.05156.
• PoUW economics - Pass et al. equilibrium arXiv:2606.06700 · usefulness gap (Pearl cuPOW) arXiv:2606.04819 · PoUW from arbitrary matmul arXiv:2504.09971.
• Verifiable inference - VeriLLM arXiv:2509.24257 · SPEX arXiv:2503.18899 · EigenAI arXiv:2602.00182 · Optimistic TEE-Rollups arXiv:2512.20176 · TOPLOC arXiv:2501.16007.
• TEE / model integrity - Laminator arXiv:2406.17548 · Attestable Audits arXiv:2506.23706 · NVIDIA CC whitepaper · dm-verity kernel docs · Tinfoil model identity.
• SDC / drift - arXiv:2502.12340 · arXiv:2605.04213 · arXiv:2604.10390.
• Composition - Miniscript · Simplicity · Clarity · Marlowe · Move resources arXiv:2004.05106 · UCAN.
• HTLC - MAD-HTLC arXiv:2006.12031 · He-HTLC ePrint 2022/546.
• Collusion - Calvano 2020 + arXiv:2504.05335.

---

Appendix C - Miner Lifecycle (End-to-End)

A worked walkthrough of the honest path (informative; the normative rules are §4-§8, §12). Operator steps: docs/onboarding/miner.md.

C.1 Onboard. Bond ≥ the capacity-proportional self-stake requirement (§6.1) via miner_staking::register_miner(commission) (miner stake is self-stake only; the commission argument is deprecated under D-0530); unbonding is slash-locked while any session/dispute/audit is open. Complete the §7 timed benchmark (SOFT: no inventory ceiling; HARD: bounded by the summed attested (SKU,count) ceiling). Deposit capacity stake before activation; the worker renews the seven-day cap from fresh canaries. Register each served model via model_registry::register_miner(...) and bind the measured dm-verity root (set_measured_root; §3.3).

C.2 Go live. Sessions are agent-initiated and 1:1; an agent selects a miner off-chain (model_registry::find_best_miners) and opens a channel. On-chain discovery/reputation is future; the chain emits reputation signals (FailedAcks) for an off-chain router.

C.3 Establish. Cooperative: after an RA-TLS handshake attests the enclave, the agent calls open_channel(miner, model_hash, measured_root, decode_policy_hash, precision, enclave_key, agent_key, sla, escrow, nonce, settlement_class); escrow is reserved and is the price. settlement_class is the Appendix F.3 settlement mode fixed for that channel. Permissionless force_open(...) implies SettlementClass::Standard and places the channel in PendingAck { ack_deadline = now + AckWindow }; the named miner accepts with force_ack(channel_id, enclave_key), where enclave_key is a session signing key and the pallet infers no TEE provenance from it. Otherwise expire_force_open refunds in full and records FailedAcks only when escrow ≥ min_force_open_escrow_for_failed_ack.

C.4 Serve. Each turn uses the signed transcript-leaf hash and running Merkle accumulator defined solely in Appendix F.3; V3 is the current TOPLOC-binding format for a channel carrying a ChannelDecodePolicies marker. The agent verifies the leaf and cumulative root and counter-signs the turn with the Appendix F.3 per-turn agent ack before accepting output. If the agent refuses to co-sign, the miner settles unilaterally at the last mutual receipt. Re-attestation recurs every k turns (§12.1h).

C.5 Claim. At close the miner posts the final root, aggregate G_n, and last mutual receipt in settle/force_settle; GnSink::validate_session_gn checks plausibility before payment (§11.2). Channel payout does not feed WorkVesting/BlockRewards, committee recency, or calibration (R11.2b). The settle path re-checks the measured root against the registry.

C.6 Close. settle (both signatures → immediate payout, no under-use refund); force_settle → finalize (challenge window 7 d ≤ W); timeout (non-delivery → full refund, φ=0); failed/early close (three-way split, §12.1d); dispute (fraud only - bisection; non-response → fraud verdict).

C.7 Extend/chain. top_up_escrow raises the reserved-capacity cap. Past D_max/n_max re-open with a fresh handshake. Mid-session crash recovery is receipt-fenced (pay only the highest co-signed cumulative receipt; unacked tail bounded by MaxUnackedGn); recovery is a fresh reopen on another miner with client-held context replay.

Grounding: miner-capacity-stake-calibration.md, r2-payment-channel-sessions.md.

---

Appendix D - Fee & Revenue Map

One payer → recipient → sink taxonomy for every money flow (informative summary of §4.2, §5.3, §9, §11, §12). Participant revenue (miner/validator earnings) is named separately from protocol runway (Labs/Foundation subsidy) and from refundable deposits (never revenue). Emission is minted; fees/escrows are transfers; burns and Foundation receipts are sinks.

The base fee converts the extrinsic base weight with WeightToFee; the encoded-length fee uses tx_length_to_fee, and the adjusted-weight fee applies the targeted fee multiplier (floor 1) to WeightToFee of dispatch weight, using tx_weight_to_fee. The tip is additional to the inclusion fee. The flop-poui inference-work price (base+priority)·gflops/1000·precision_mult (§4.2) is a separate charge. Under D-0529, protocol-wide transaction-fee burn is 0% (BurnFees = 0) and 100% of inclusion fees and tips route to the block author (§9.1 R9.6).

Runtime-constant ⇄ SDK/explorer cross-map and the residual indexer schema cleanup (reward_distributions burn_share/treasury_share/staking_share vs. the emitted miner_share+validator_share) are tracked as an implementation cleanup, not a protocol decision. Provenance: D-0435, D-0408, D-0403, D-0412, D-0407, D-0409, D-0421, D-0529, D-0530, D-0531. Grounding: fee-design.md, miner-validator-economics.md, agent-token-economics.md.

---

Appendix E - Open Specification Items

Each unresolved value/definition/mechanism has a numbered stub: what must be specified, a placeholder to model against until it ratifies, its home section(s), and the blocking decision/task. Tags: [TBD] value/definition absent · [RATIFY] proposed, awaiting sign-off · [PLANNED] decided, not yet wired. To close an item: write the value into its home section, then delete the stub (closed numbers are retired, not reused).

E.8 - Value-coupled floor k + retarget cadence [TBD]. Set k in effective_minimum_stake = max(baseline, k·V_booked) and its governance retarget cadence. Placeholder: k ≥ m·κ/(θNσδ); slow-cadence retarget from the indexer D₂/n_eff. Home: §11, §15.2. Blocking: #556.

E.9 - Governance track magnitudes [RATIFY]. Sign off the protocol_upgrade track values. Placeholders: min_support linear 50% → 15% of ActiveIssuance; decision period 28 d; prepare/confirm 2 h / 24 h; decision deposit high-FLOP, magnitude TBD (the runtime currently carries 100,000 FLOP); enactment timelock 14 d (protocol_upgrade_enactment_timelock) against the §1.2 reading rule that enactment outlives the 21 d validator unbonding - sign off the value or the rule. Home: §14.1. Blocking: #681.

E.22 - Aggregate reservation + statistical drift + cache-aware metering [PLANNED] (M6/M13). Quick-canary count, timed packs, lease/renewal cadence, restart supervisor, expiry, multi-GPU fingerprint invalidation, and deposit-before-activation are live under D-0433. Remaining: miner-wide capacity reservation across overlapping channels; rolling eligible-work coverage and automatic degradation downshift; canonical production fingerprint acquisition; per-SKU MLPerf plausibility datasets; and a proof-bound cached-prefix witness so reused prompt prefill is not charged again. SPEC-026 applies ceiling rejects, co-signed EWMA rebates, reputation, and slashing only for timing fraud. Home: §4, §7, §13.1. Decision: D-0433. Blocking: #1822; cache witness #1153.

E.23 - Minimum-escrow / bonded-reservation economics [TBD] (A10). Dust count is bounded by the per-identity reservation cap and the min_force_open_escrow_for_failed_ack floor, but the general pricing of a minimum escrow / bonded reservation is unspecified. Home: §13.5. Blocking: #440.

E.24 - Ordering-game / MEV analysis [PARTIAL] (V7). Strict dispute guard vs. non-strict finalize guard commute at a fixed finalized head; the residual force-settle path exposure is ≤ one escrow. Binding settlement mode in the signed receipt or defining protocol path priority removes the choice. The same choice is open to the agent: G.1 admits force_settle from either party, and at the placeholder tariff (channel_base_per_turn and rate_G each one base unit) P is n + ΣG_n base units, so even 10¹⁰ G_n (tens of millions of tokens on a 70B-class model) pays 10⁻⁸ FLOP, and an agent that declines to co-sign recovers essentially (1−φ)·E of a used channel against R12.1a's intent. Restricting the unilateral caller, binding the settlement mode at open, or raising the tariff to a cost-covering magnitude is part of this item. Operational maxDelay, FOCIL enforcement, and path-binding remain open. Home: §12.1, §13.2. Blocking: #445, #1610 (tariff calibration).

E.27 - Session max-duration extension + re-attestation cadence wiring [PARTIAL]. The cadence bound k ≤ min(Bond/v_turn, T_tcb/t_turn) is specified; in-place max-duration extension and the re-attestation cadence are not yet wired. Home: §12.1, Appendix C. Blocking: #682 (SPEC-025).

E.41 - Active-set cap vs. BABE authority bound [RESOLVED]. D-0437 ratifies validator_active_set_cap = 1,000. Resolved via Option (a) (D-0526): MAX_ACTIVE_VALIDATORS and MaxAuthorities are raised to 1,000 so every active validator is a BABE block authoring authority. AlephBFT finality remains sub-sampled to the 100-member PoUI-gated committee (finality_committee_size = 100, AlephMaxCommittee = 100). Storage bound for ActiveValidators is aligned from ConstU32<10_000> to ConstU32<1_000> with decode-compat verified against prior SCALE encoding. Home: §15.5, §15.4. Decisions: D-0437, D-0526. Closed: #1393.

E.42 - Committee seat-capture model [TBD]. Establish a capture bound for the implemented weighted-without-replacement draw over distinct eligible identities. The model must use seat count as the AlephBFT safety variable and cover unequal stakes, small eligible pools, stake splitting, repeated draws, and BABE-VRF seed influence. Retain the 40 Byzantine identities at stake 1 versus 61 honest identities at stake 3, drawing 100 of 101, as a regression case: Byzantine aggregate stake is 40/223 ≈ 17.94% while every draw contains 39 or 40 Byzantine seats. Placeholder: no aggregate-stake/binomial bridge; conformance requires a separately justified strict <⅓ Byzantine-seat premise. Also specify the zero-duty bootstrap fallback, the nonempty-but-undersized duty pool, and a minimum safe committee response; an N=100 bound cannot apply silently when the implementation returns fewer seats. Home: §2.3, §13.2, §15.4. Blocking: new consensus decision, exact sampler analysis, undersized/bootstrap policy, and formal witness. Tracking: #848.

E.43 - End-to-end verification/error bridge [TBD]. Specify and test the commitment/challenge/opening protocol that connects TOPLOC's empirical detector and projection formula to settlement: activation-vector binding, decode-step coverage bound to the billed h_ids, post-commit challenge randomness, opening verification, quantization/backend distributions, adaptive attacks, DA publication, audit selection, and adjudication. State conditional error terms; use a product only with justified conditional independence. Placeholder: artifact presence records a claim but does not establish execution correctness or a cryptographic false-accept rate. Home: §3.2-§3.5, §12.1, Appendix F. Blocking: protocol design, adversarial matrix, and implementation-to-proof conformance test. Tracking: #1493.

E.44 - Cooperative work-credit eligibility [PARTIAL; future activation/recovery TBD]. The confirmed payment-only disposition suppresses new public credit at every current-profile channel payout, including unilateral finalization and DA void. Production-runtime regressions exercise a self-funded/related payer+miner coalition with ordinary SOFT keys, valid signatures and plausible fabricated amounts, replay, mismatched evidence, and delayed fraud. Signatures, Merkle membership, and sum equality prove agreement and arithmetic, not claimed execution. Closed-channel reports reject; duplicate reports do not recover payment or alter reward/recency state. Historical credit and issued rewards are preserved, with no implemented clawback. Future activation still needs independently auditable/final execution evidence, challenge standing/deadlines, retention of collectible collateral, and correction/recovery of historical credit/rewards and eligibility. The distinct decision ID and exact public bundle await owner approval. Home: §3.6, §9, §11.2, §12.1, §15.6. Tracking: #2375; #1494's payment-only containment is completed. Private evidence: runtime observations.

E.45 - Effective-challenge incentive model [TBD]. Define players, utilities, challenger rewards and costs, coalition/bribery behavior, exposure horizon, collectible collateral, and miner-wide reservation across concurrent channels. Expand p_effective into availability, selection, inclusion, correct adjudication, and collection events, with each factor conditioned on all prior events and without an independence or Markov assumption. Placeholder: total_profitable_exposure < p_effective × collectible_penalty is a conditional risk-neutral deterrence budget, not a unique-equilibrium or zero-fraud theorem. Home: §3.5, §6.1, §11.3, §12.2. Blocking: aggregate reservation E.22 plus a ratified payoff model. Tracking: #1495.

E.46 - Direct/session capacity evidence [PENDING; PARTIAL EVIDENCE]. This mechanism remains open. Internal source-checked fixtures reproduce exact SCALE bytes for supported direct active-set/quorum sizes and cooperative/unilateral settlement over turn/path limits, a duplicate-last bundle, TOPLOC evidence publication, and dispute calls. It includes runtime pallet/call indices, v5 bare and v4 signed framing, signature/extension fields, compact length prefixes, DA references, hashes, configured Normal/Operational envelopes, and charged weights. The direct weight is an identified unbenchmarked stub; session weights do not parameterize path length or duplicate scanning. The runtime-benchmark build now compiles in every runtime flavour, but no benchmark run, dedicated flop-poui weights or runtime hash is claimed. No disclosed network matrix or raw log exists. Detailed failure diagnostics and their reproducer remain private while the mechanism is pending; the public summary records only the fixtures' bounded scope and limitations. D-0502 proposes withdrawing the 125,000 B, 96/128 transaction, 48/64 lifecycle, and sub-second-finality figures from the v0.5 profile; ratification is pending. Home: §2.2, §5.2-§5.3, §12.1, §15.6; evidence: prepublication-evidence.md. Blocking: run the runtime benchmarks, generate dedicated weights, and run the recorded committee/topology/loss/load/co-load/fault matrix with negative and recovery outcomes. Tracking: #1496.

E.47 - DA availability and anti-grinding model [TBD]. Specify commitment-assignment anti-grinding (paid-storage provider assignment already draws delayed BABE randomness after open, §5.4; protocol-DA assignment is still seeded by the commitment), operator and failure-domain diversity, publisher limits, audit/repair timing, repair bandwidth, an upper bound on lease_end under free third-party top-up, the resolution of an audit still outstanding when its blob is withdrawn or pruned, and the cumulative storage/retention budget across the full session+challenge lifecycle. Distinguish registry freshness, audit success, and actual reconstruction. Placeholder: validator DA removes miner-only custody; availability remains conditional on the stated threshold and repair assumptions. Home: §3.5, §5.3, §13.0, Appendix F. Blocking: failure model, grinding analysis, and lifecycle recovery test. Tracking: #1497.

E.48 - Cross-chain HTLC pair conformance [TBD]. Specify the exact chain and asset identifiers, participant/recipient and hashlock binding, preimage owner/reveal path, timeout orientation and margins, per-leg finality and timely-inclusion assumptions, relayer failure recovery, and the fee/inclusion premise required by HtlcIncentives::collusion_deterred. Closure evidence must exercise both legs under the ratified profile and record timestamps, finality identifiers, and hashed raw RPC/log inputs. Placeholder: FLOP-leg conservation and mutually exclusive redeem/refund are supported; the initial-publication disposition for every implemented pair/direction is target-only, with cross-leg loss/stall counterexamples preserved in the pair evidence. Pair conformance remains PENDING and must not be presented as a deployed guarantee. Home: §10. Blocking: chain-pair design, implementation, and closure evidence. Tracking: #1498.

E.49 - Independent-demand and value-at-risk model [TBD]. Model miner+agent+validator coalitions, self-dealing genuine work, reward recycling, subsidy cliffs, audit outage, adverse FLOP price, attacker ownership/control concentration, and aggregate exposure in external assets. Separate protocol-authorized demand from economically independent demand and legitimate bootstrapping from profitable wash demand. Placeholder: no external-demand inference from a co-signed paid receipt; value-coupled security remains conditional on E.8/E.35 and unresolved genesis/reward distributions E.38-E.40. Home: §9, §11, §12.3, §15. Blocking: coalition payoff simulation and disclosed input distributions. Tracking: #1824.

E.50 - Arbitrary runtime-upgrade scope [TBD]. Define the approved-code/social-governance assumption for Root set_code, including review, publication, voter verification, emergency handling, and what claims survive arbitrary bytecode replacement. Placeholder: current-runtime parameter guards, de-sudo state, and formal update invariants apply only to the approved runtime and modeled calls. Home: §9.3, §14. Blocking: governance threat model and upgrade-review policy. Tracking: #1499.

E.51 - Canonical wire-format operational binding [PARTIAL]. The byte formats, strict decoders, domain/version tags, explicit leaf dispatch, and cross-language vectors are fixed. Remaining: production task producers and validator/oracle consumers must derive task_hash v1 from the deployment genesis, agent, nonce, model, payload, and commit inputs and reject a caller-supplied mismatch; resumed pre-E.51 channels and stored checkpoints must retain their legacy receipt profile while new channels remain v1-only. R3.1's presence gate is the channel-level submit_toploc_evidence record (F.6), checked at settle/force_settle regardless of leaf version; a V2 leaf under a decode-policy marker satisfies presence but not per-turn binding. SDK hosts refuse a TOPLOC-bearing V2 leaf (#1404); whether the runtime keeps accepting V2 under a pinned policy is decision #1594. Placeholder: the direct rail treats task_hash as an opaque H256, and receipt selection is safe only when the channel's profile marker survives the entire resume/checkpoint path. Home: §3.6, §12.1, Appendix F. Blocking: producer-to-validator wiring and cross-version resume-to-settlement tests. Tracking: #1500.

E.52 - Verification-liveness gate wiring [PLANNED]. R15.4c is ratified (D-0439) but the runtime still refreshes LastVerifiedWork from prover credit (ValidatorWorkRecorder on OnProofVerified, with who = the miner) and from nothing else; no duty is protocol-issued (issue_audit and ghost tasks are root-only) and no validator attestation client exists. Wire the accepted-duty writers (attestation-bundle signers, TOPLOC/escalation quorum signers, DA audit responses, validator dispute openings), remove the prover adapter, make the rotation floor read the same signal, add the per-window known-answer challenge issuance (fixture set in runtime/genesis; da_registry::issue_audit cannot serve it - it rejects when no blob exists) and its parameter, and record the storage-naming choice (a rename is a storage-key change: decode-compat test). Placeholder: until wired, the committee behaves as the zero-duty bootstrap fallback of E.42 (stake-only), and a validator that also mines is the only one that passes the gate. Home: §2.3, §15.2-§15.5, Appendix H. Blocking: #1552 (runtime), #1554 (attestation client).

E.53 - Re-execution checker lane [PLANNED]. R3.5d is ratified (D-0439) but the shipped TOPLOC checker has each validator re-run prefill (toploc-checker.ts GPU executor; report_toploc_mismatch quorum over validator-recomputed distances). Specify and wire the checker registry keyed to calibrated miner identity (attested hardware fingerprint + capacity stake, §2.4) and its bond, stake-weighted VRF assignment of three fingerprint-distinct checkers per sampled or challenged turn (capture ≤ q³), re-challenge of a unanimous accept with a disjoint draw and bond forfeiture on overturn, the verdict fields carried by report_toploc_mismatch(_claim) (assignment proof, bond reference, signed distance over the commitment), the validator-side verification before co-signing, escalation on any non-unanimous or unavailable result (§12.1), the OPTIONAL TEE-attested verdict tier, and checker payment through claim_audit_fee bound to the assignment. Also open: whether the verdict must commit to a recomputed value, since q³ bounds seat capture but not the acceptance rate of a checker whose verdict does not depend on re-execution (yellowpaper#3), and whether pairwise-distinct fingerprints are the whole of R3.5d's "distinct operators" (yellowpaper#13). Placeholder: validators re-execute; no bond or independence among checkers. Home: §3.5, §12.1, §15.6, Appendix F/G. Blocking: #1553.

E.55 - Canonical pre-session quote/discovery contract [PLANNED]. Define a versioned, signed off-chain compute-channel quote and a public quote → open_channel → receipt conformance fixture. Home: the Rust and TypeScript compute-channel SDK interfaces, with their wire binding in Appendix F. The existing StandingOffer / SessionOffer v1/v2 binds the miner, model hash, precision, minimum escrow, service bounds, capacity hint, expiry, nonce, and optional forward terms; it is an opening offer, not a reproducible cross-provider cost quote. The fuller contract must also bind the meter profile, input/context/output and cache assumptions, verification/settlement tier, expected G_n, reserved escrow and expected payable in an explicit base unit, transaction fee, and any external display conversion. Until those fields have a canonical mapping, routers preserve source units and decline cross-provider ranking. Blocking: #1597 (reproducible long-context G_n) and #1586 (reservation price formation). Tracking: #1825.

E.56 - Small-set rotation ejection guard [PARTIAL; policy TBD]. Runtime containment is implemented: pallet_validators enforces validator_min_active_validators = 4 on voluntary deregistration, jail, kick, and rotation (ensure_can_remove_from_active), caps rotation ejection by validators_to_eject = 50, validator_rotation_churn_percent = 10%, and validator_min_scored_samples = 3, and slashes/blacklists a proven fault at the floor immediately while deferring seat removal until rotation promotes replacements. Open: the floor's relation to the seeded launch cohort (20-50 seats, D-0507), to E.42's committee-safety premise, and whether an ejection batch that reaches the floor is skipped or truncated under the ratified rotation policy (D-0508). Placeholder: the 4-validator floor is a non-drain guard, not an N=100 committee-safety proof. Home: §15.5. Blocking: D-0508 ratification and E.42 alignment. Tracking: #1792, #1711; containment #1727 completed.

E.57 - Validator unbonding vs dispute lifecycle [TBD]. State one right-hand side for the validator stake-exit bound and make §15.7, V11 and Appendix I agree with it and with the runtime. D-0419 ratifies freeze-while-open for all stake; the validator-side freeze is not wired, and under R1.2a's multi-round bisection worst-case dispute lifetime D + (2·⌈log₂ n_max⌉ + 2)·R = 763,200 blocks (8 d 20 h at n_max = 1,024, R = 2 h; replacing the superseded single-turn 7 d + 2 h + 2 h = 7 d 4 h bound), sequential composition with DA retention W (14 d = 1,209,600 blocks) gives W + 8 d 20 h = 22 d 20 h (1,972,800 blocks), which exceeds validator_unbonding_blocks = 21 d (1,814,400 blocks) by 1 d 20 h (158,400 blocks), whereas the §1.2 coupling (763,200 ≤ W) bounds the lifecycle by W (14 d < 21 d) when it starts inside retention. Define the validator "dispute lifecycle" (attestation bundle, DA audit, mismatch quorum) and its start clock. Placeholder: the validator relies on the 21 d cooldown; no unbond-during-dispute conformance claim on the validator side. Home: §1.2, §13.2 V11, §15.7, Appendix I. Blocking: a decision choosing freeze (pallet change) or margin (value or composition), recorded as a D-id superseding D-0419's validator leg. Tracking: #1607.

E.31 - DA-loss terminal settlement split [TBD]. Resolve whether D-0430's full-refund rule remains in force or a separately justified "pay last co-signed cumulative receipt, refund the unverifiable tail" rule supersedes it, including the evidence predicate, work-credit and forward-channel disposition. Placeholder: full escrow refund on terminal unrecoverable DA. Home: §13.0, §13.2. Blocking: #1948.

E.32 - Sponsored stake refund semantics [PARTIAL]. D-0530 prohibits third-party delegated staking into validators or miners (operator stake is self-stake only), leaving only institutional/Foundation sponsored stake (SponsorPosition) in scope here. Ratified for devnet and testnet (R6.1a): a sponsor-owned, stake-only bond that counts as self-stake on runtimes with sponsored_self_stake_enabled, refunded only to the sponsor after the role unbonding window on the finalized prefix, reward routing per the recorded position policy, and own and sponsored stake disclosed separately. Still open for mainnet: whether sponsored stake can ever satisfy self-stake, per-sponsor and per-operator caps, and slash collectibility when the sponsor holds its frozen principal under another pallet's fungible hold (holds overlap freezes; the same gap applies to self-stake and delegator freezes). Such a slash fails atomically, and the dispatch that needs it fails with it: a channel finalize that forfeits audit stake cannot complete until the hold is released. The slash waterfall is fixed in §11.3. Placeholder: mainnet does not count sponsor stake as self-stake. Home: §6.1, §11, §15, Appendix C/D. Blocking: #683 (mainnet).

E.33 - SOFT-tier (non-TEE) miner class [TBD]. Define the non-TEE assurance tier end to end: entry (verified calibration burst + stake, no TEE/SKU evidence), settlement (miner session-key turn signatures

• agent receipt in place of enclave signatures), dispute resolution (validator quorum over checker-lane re-execution, R3.5d, instead of enclave-sig proof), spot-check rate, per-miner demand-floor exclusion (no hardware identity ⇒ per-miner floor payments are Sybil-farmable), and pricing disclosure to agents. Placeholder: SOFT = discounted provisional cap + surge multiplier ≥ 1 + soft_tier_spot_check_rate_ppm; HARD = min(empirical, discounted SKU) when TEE evidence exists. This item is the load-bearing dependency of the ratified TEE-optional reframe (D-0432, §3.2 R3.2): the SOFT tier is admitted as first-class but its settlement/dispute path is not yet fully specified. Home: §3.2, §4, §7, §12, §13. Blocking: #650.

E.34 - Work-certificate workload classes beyond LLM [PARTIAL]. Class-aware G_n metering (LLM/diffusion/world-model/policy-control + class-adjusted tripwire ceilings) landed. Still open: per-class certificate coverage and verification choice, freezing workload_class on the cert wire beyond v1's LLM/GEMM-only value. The premium settlement floor ≥ 1.5× landed in #535. Placeholder: non-LLM classes launch TEE + sampled-audit replay; GEMM sum-check is the premium inline option. Home: §4, §7. Tracking: #1944 (including the cert-wire class binding).

E.35 - Validator-stake bidirectional retarget and aggregate κ [TBD]. Define the stake-floor reduction mechanism (bounded step, TWAP window, hysteresis, hard floor at the CoCVoC baseline, announcement/grace ≥ unbonding) and whether κ_cc and the aggregate stake-to-secured-value target (~20%) unify into one ratified κ. Placeholder: no down-retarget; base floor ratified at 1,200,000 FLOP (D-0440; the CoCVoC requirement is ≈1,163,309 FLOP). Home: §11. Blocking: #556.

E.36 - External-work attestor classes [TBD]. Define market-grade attestor sets for escrow-settled off-chain work (data curation, PR review, API SLA): registry shape, set-version pinning at escrow creation, mandatory timeout arms, assurance labeling (market-grade never presented as protocol-grade). Home: §13, Appendix D. Blocking: #637.

E.37 - Attested-transport privacy posture (CVE-2026-33697) [TBD]. Relay attacks on attested TLS break evidence↔channel binding; settlement integrity is unaffected (money moves only against the on-chain-committed enclave key's signatures) but session confidentiality and the open_channel rendezvous inherit exposure. Placeholder: no session-privacy claims beyond TEE memory encryption; rendezvous treated as untrusted transport. Home: §12, §13. Blocking: #1823.

E.38 - Unresolved conversion and release policy [RATIFY]. §8.2 specifies the decided genesis allocation and airdrop path. Placeholder: ratify conversion score caps and sublinear aggregation, the accounting identity and owner-signed spend rules, verifiable-demand and maintained-duration gates, the validator cohort's activity basis, and whether activity under-counts can be appealed. Fix the Validator release order of R8.7; until it is fixed, no Validator grant releases. Decide the disposition of Miner and Agent principal that never unlocks. Whether a fraud verdict upheld after the dispute window reverses unlock or spend credit follows E.44. Residual risk: once its quarter is liquid, a miner can buy inference from itself through an agent it controls and unlock the rest at the 15% validator fee leg (of which 1% funds the audit pool; D-0525), roughly 11.25% of principal; an agent can likewise pay a miner it controls from locked principal, receive about 85% of it back as that miner's payout, and unlock a further third of the spend. No runtime common-control rule binds either (see E.49). Under D-0531 (#1358), the workbook's legacy on-chain referral commission model (6-10%) is superseded by a public explorer leaderboard and periodic referral lotteries funded from genesis_reserve = 800,000,000 FLOP and settled off-chain. Decide the unallocated-remainder disposition, publication of operator-held filter inputs, and the genesis_reserve release controller. Home: §8.2, §9.3. Blocking: #257, #1175, #1354, #1357, #1358.

E.54 - Paid agent-storage activation profile [RATIFY]. Fix the §5.4 canonical wire widths/order, message domains and cross-language vectors; ciphertext/chunk/erasure/key-wrapping suites; capability, revocation, lane-close and key-recovery boundaries; the funding-pinned lane claim window lane_claim_window_blocks and its residual post-close budget exposure; custody/audit proofs with unpredictable challenges, selection/standing and objective fault adjudication; activation, service, challenge, repair and terminal retention windows; collateral reservation, encoding of slot/tranche budgets, slash/compensation disposition; and capacity, object/request/credit limits with benchmark-backed tariff economics. The profile MUST separate client encryption obligations from validator-checkable envelope predicates, and pin per-write setup entitlement, the setup-fee floor (when F = 0 is admissible given R5.4e's one-time-work coverage), encoding and bounds for R5.4f's per-slot/tranche position accumulators and historical entitlements, take-or-pay reservations with capacity reuse and transfer semantics, reservation cardinality per payer (one active reservation or one per term, and whether terms may overlap; §1.1 vs F.7), fixed service-lane tariffs with advanced request fees, the head quorum and whether any two head quorums of one provider group must share a signer (2q > n), sequencer deadline and failover order, checkpoint cadence and grace, the audit-rate inequality p_a × c_r ≥ c_s and any one-time shard-derivation proof at object activation, bond netting against held-back earnings, and separate fault remedies. The rounding and replacement entitlement rule is fixed by R5.4e/f; no tariff, bond or audit-rate value is ratified here. It MUST pin aggregate attempted-work/traffic/credit accounting, retry bounds, restart behavior, monotonic-time replenishment and protected protocol reserves, including failed admission and repair paths. Placeholder: paid storage disabled (outside the R5.4q development-network scope, D-0512); no numerical launch rates, compensation guarantee, or continuous-availability claim. The activation profile MUST enumerate each new protocol limit's name, unit, allowed range, consumer, governance mutability, and existing-deal behavior. The E.54 profile MUST constrain its permitted activation, challenge and funded-request timing so that, for every lane close boundary C, the funding-pinned lane_claim_window_blocks W covers the maximum remaining setup-entitlement maturity and every funded-request deadline affecting that lane's claims. Each such entitlement MUST become redeemable, and each such deadline MUST expire, no later than C + W, accounting for sequential delays and inclusive/exclusive boundary rules. A profile or admission permitting an obligation beyond that deadline MUST be rejected; missing bounds MUST NOT be treated as zero. Profile qualification and admission MUST establish, under protocol-permitted finality behavior, at least one actual runtime dispatch opportunity after all entitlement prerequisites complete and while known finalized height remains at or below the unchanged deadline. Unsupported or missing bounds MUST reject qualification/admission, and affected work MUST NOT be enabled before that qualification, including on development networks. This establishes redemption validity, not guaranteed transaction inclusion; maturity-time arithmetic alone MUST NOT be claimed to exclude a finality jump across the entire redemption interval. Ratified numerical protocol limits MUST enter the canonical parameter YAML, generated Appendix A, and caller-consumption checks together with their implementations. The profile MUST fix the epoch tariff's electorate (capacity-declaring validators), stake weights, median aggregation and ties, missing votes, the per-epoch step bound, any governance floor/ceiling, the demand-headroom tripwire and its epoch count, the response to sustained over-supply, update boundaries and immutable versions, with strategic-vote, cartel and under-supply analysis against measured provider costs; binding prices are the epoch tariff under R5.4e. Accepted tariff versions MUST remain versioned reservation inputs; hardware costs, token conversion assumptions, and demand/margin estimates MUST remain operator/simulator inputs. Home: §5.4, F.7, G.4. Decision: D-0506. Blocking: profile ratification, economic/adversarial evidence, E.47 placement/repair evidence, and an end-to-end implementation witness. Tracking: #1564, #1565, #1566, #1567, #1568, #1569; Lean, Quint and simulation evidence landed in #2397, #2142 and #2152.

E.40 - Agent & staker leg distribution [TBD]. Specify how the agent_share_ppt (10%) and staker_share_ppt (5%) pools are paid out: under D-0530, the 5% staker_share_ppt leg is allocated to the duration-locked community staking pool across seven lock duration tiers with zero slashing risk and no validator or miner intermediary (exact tier weights and claim distribution mechanics remain E.40); the eligible set for the agent leg and its pro-rata basis (agents: verified inference spend, unconfirmed), cadence, dust handling, and, for the staker leg, whether payouts are liquid on issue (agent-leg payouts are liquid under R9.13). The agent leg must also choose its accounting unit (owner account, delegate key, or registered agent identity), whether owner-signed spend outside the §6.2 delegate caps counts (yellowpaper#31), and its spend basis: escrow-settled reserved value or work-settled Σ G_n over co-signed, TOPLOC-carrying turns (yellowpaper#32). Per-identity accounting makes identity count the reward lever, so per-identity credits need verifiable-demand gating. Until this ratifies both legs accrue in sovereign pool accounts and are never distributed (§9.1 R9.12). Placeholder: duration-locked community staking pool across 7 tiers for the staker leg; the agent accounting unit and spend basis remain unconfirmed, with both escrow-settled and work-settled bases open. Home: §9. Blocking: #1350, #1351.

---

Appendix F - Message & Storage Formats

Canonical on-the-wire and on-chain field layouts (normative). All hashes are 32 bytes; multi-field preimages concatenate (‖) fields in the order listed. SCALE is the codec for on-chain storage/extrinsic payloads unless noted. The canonical positive/negative corpus is evidence/wire-format-v1.json, validated by evidence/wire-format-v1.schema.json. Generate or check it with uv run --script evidence/generate-wire-format-vectors.py [--check]; Rust, TypeScript, and Python tests consume that same file.

Rationale & sources. This corpus checks wire-format conformance only; Appendix F does not discharge money-path conformance. Amount transitions have a separate money-path-v1 corpus and coverage notes. Landed cases pin their yellowpaper commit and decision ID and check balances, events and storage through the pallet runner; unresolved payout alternatives remain pending under their decision owners.

F.0 Codec and rejection profile

• Fixed unsigned integers are exactly u8/u16/u32/u64/u128, little-endian. Encoders MUST reject negative or overflowing inputs; no saturation, truncation, floating-point conversion, or rounding is permitted. H256, AccountId32, public keys, and signatures are raw 32/32/32/64-byte strings.
• SCALE struct fields concatenate in declaration order. Enum discriminants are one byte and listed below; bool is 00/01; Option<T> is 00 or 01 ‖ T; Vec<T> is canonical SCALE Compact<u32>(count) ‖ items. Unknown tags, invalid booleans/options, non-minimal compact integers, truncated fields, bounds violations, or trailing bytes inside a length-delimited object MUST be rejected.
• Compact<u32> uses one byte below 2⁶, two below 2¹⁴, four below 2³⁰, and 03 ‖ u32LE otherwise. Lengths are element counts, never byte counts. The public corpus includes 0, every mode boundary, u32::MAX, truncated encodings, overlong encodings, and values wider than u32.
• Hashes are over the exact bytes shown, with no implicit SCALE, UTF-8 terminator, length, or personalization beyond an explicit domain. sr25519 uses the Substrate b"substrate" signing context and signs the stated message bytes or 32-byte leaf hash. Outside F.7's storage messages, the signed messages are the validator attestation, transcript leaf, agent receipt v1, and per-turn agent ack; the ack message is channel_id ‖ turn_index:u32LE ‖ leaf_hash ‖ agent_send_ms:u64LE ‖ agent_recv_ms:u64LE.

F.1 Identity & binding preimages

The direct rail's runtime cannot reconstruct task_hash because the payload, commit, agent, and nonce are not all call arguments. Its deployed enforcement starts at exact equality with the pending H256 and local replay rejection. This is an explicit trust boundary, not an implicit fallback: cross-deployment protection depends on the active validators enforcing the producer-side v1 derivation before attesting.

F.2 Attestation & proof (direct rail, §3.6)

F.3 Session transcript (compute-channel, §12.1)

SettlementClass selects settlement semantics; it is not the HARD/SOFT assurance tier. The latter is a separate miner-calibration snapshot captured at cooperative open_channel or permissionless force_ack. The enclave_key argument supplied on either path is a session signing key; the pallet does not verify or imply TEE provenance for that key.

R12.1i - Receipt payable. Verification MUST derive the agent receipt v1 payable from channel state and the settlement path, as the row above defines it.

Accepted-version cutoff. A present ChannelDecodePolicies[channel_id] accepts only explicitly tagged V2/V3 leaves and requires an equal policy hash; an absent marker (a channel opened before policy binding) accepts explicit V0-V3. ChannelWireProfiles[channel_id]=1 requires receipt v1; an absent marker accepts only the historical untagged 96 B receipt preimage, and an unknown value fails closed. New opens write the decode-policy and wire-profile markers. Existing channel records and amounts are not rewritten. V2 remains an explicitly lower evidence format and MUST NOT be reported as V3/TOPLOC-bound assurance. SDK hosts refuse a TOPLOC-bearing V2 leaf (#1404); removing the runtime's remaining acceptance or adding a binding is decision #1594.

R12.1j - Per-channel decode policy. At open, ChannelDecodePolicies[channel_id] pins one decode_policy_hash. That hash MUST be identical across every V2/V3 turn under the channel_id and MUST NOT vary by turn, regardless of how many agents participate in the pipeline.

DA transcript container. Current SDKs emit FCC4 ‖ channel_id:H256 ‖ turn_count:u32LE, followed by each turn as leaf_version:u8 ‖ turn_index:u32LE ‖ h_in ‖ h_out ‖ g_n:u128LE ‖ has_policy:u8 [‖ policy_hash] ‖ h_ids:H256 ‖ toploc_hash:H256 ‖ recv:u64LE ‖ done:u64LE ‖ latency:u64LE ‖ enclave_sig:[u8;64] ‖ has_ack:u8 [‖ send:u64LE ‖ receive:u64LE ‖ agent_sig:[u8;64]], where agent_sig signs channel_id ‖ turn_index:u32LE ‖ leaf_hash ‖ send:u64LE ‖ receive:u64LE under the channel's agent key. has_* is exactly 0/1. FCC4 version/field consistency is fail-closed: V0/V1 have no policy and zero V3 fields; V2 has a policy and zero V3 fields; V3 has a policy and non-zero h_ids. Decoders consume exactly the declared turns and reject trailing/truncated bytes. Rust/TS may read historical unprefixed/FCC2/FCC3 blobs only to migrate them into an explicit in-memory leaf version; they never make an on-chain version choice from signature success.

F.4 Data availability (§5.3)

F.5 TOPLOC band constants (§3.4)

Per-(model, precision) governance-set constants consumed by band_verdict / report_toploc_mismatch: kappa_profile_hash, band_tau_accept, band_tau_slash (see toploc_band_tau_accept_bf16_milli, toploc_band_tau_slash_bf16_milli). Two-threshold policy: accept / escalate / slash; a cell is adjudication-inert (commitment-required) until its hetero-hardware gate passes.

F.6 Acceptance/settlement trace

---

F.7 Paid object storage (§5.4)

R5.4o - Record encoding. Each record MUST carry an explicit profile version and reject unknown variants. Signatures MUST bind chain genesis hash and distinct message-type domains. All lists/strings MUST be bounded. The logical fields below MUST be present; canonical widths, field order, codec/cipher suites, domain bytes, and cross-language vectors MUST be fixed by E.54 before activation.

---